d83084e5a229b51008a4af6c8cf1fbb3b61cc083b1f06f6da823dc5afe8fef47 | Triage

Analysis

max time kernel
15s
max time network
16s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
17-05-2024 23:24

Sharing

Report Analysis Logs

General

Target

download.exe
Size

4KB
MD5

5b71d7d459d3326c56f51b87b26a566f
SHA1

f8fd9d1727120c651fa6b1b00f15741a8985568c
SHA256

d83084e5a229b51008a4af6c8cf1fbb3b61cc083b1f06f6da823dc5afe8fef47
SHA512

7299a2d4ed60c17001eb2b7d3581fda2b5783b9e4a755935470ddb9a86fab2d7804ab4b62d7d8e771123715a172e46cb1c6e2867e39558d8b648f801b7d8ffae
SSDEEP

48:6uZeis1dklrVe/nbE/AQX2izgruwCjZ8qyWiIqUXO9qK0AW0Xq:/U1deReKAi2ggr8jZ3HHv

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2188 2036 WerFault.exe download.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

download.exe

description	pid	process	target process
PID 2036 wrote to memory of 2188	2036	download.exe	WerFault.exe
PID 2036 wrote to memory of 2188	2036	download.exe	WerFault.exe
PID 2036 wrote to memory of 2188	2036	download.exe	WerFault.exe
PID 2036 wrote to memory of 2188	2036	download.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\download.exe
"C:\Users\Admin\AppData\Local\Temp\download.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 48
2⤵
- Program crash
PID:2188

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...