48bbc6f4ee8ccfe253f018fbcd99560c4680fd79160c75335c76d49620272a5c | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 13:58

Sharing

Report Analysis Logs

General

Target

file.exe
Size

481KB
MD5

005b2bb9551172ef81a1fcf2da3637ad
SHA1

f48f1e29f892e792b4f4e3126e624ff32adb00d8
SHA256

48bbc6f4ee8ccfe253f018fbcd99560c4680fd79160c75335c76d49620272a5c
SHA512

515f693d84af9e90f0e2d4cefff1f6071cc7b5375a464310d2632305c24ee6ca5e1b966c7667ee83e9dcfe629aefe8f115089d58bd4908d690d133beb84ddbd2
SSDEEP

12288:xBxLtOghOAbGX0TTcdGhtnkFeUYmWvh52DU+O2jf0cokPnFS7gr:xBjLhOtmcyV9cY8Vt

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2756	2896	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2756	2896	file.exe	29
PID 2896 wrote to memory of 2756	2896	file.exe	29
PID 2896 wrote to memory of 2756	2896	file.exe	29
PID 2896 wrote to memory of 2756	2896	file.exe	29

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 52
  2⤵
  - Program crash
  PID:2756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2896-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2896-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download