5244d86acc75581ee5bb96d41b685062bbeaade00639c2aa8be9b402e969385a | Triage

Analysis

max time kernel
131s
max time network
137s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 14:29

Sharing

Report Analysis Logs

General

Target

7.exe
Size

805KB
MD5

4c2e404e8f200fec75a42520c8a41d0b
SHA1

d3f6d79675e8a8dcba9e4cd254844ba314621d86
SHA256

5244d86acc75581ee5bb96d41b685062bbeaade00639c2aa8be9b402e969385a
SHA512

b45b320498b558099a1b994e8e3e7e62cbc924fad4b1dfc5d97259a2664540c2aa1069855f7e5a179ff5b7bf76bb168c8685de98d9c348f2b343966371cddb90
SSDEEP

12288:Se2aULcRTx7PyGrdItxqJ5/vHau+YVAXxJdT+BN8kQkgpIkqhb1xRqgbkieiO+RD:chWTx7PJdIaXv6u+YVABPSi4xG

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1640 1440 WerFault.exe 7.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

7.exe

description	pid	process	target process
PID 1440 wrote to memory of 1640	1440	7.exe	WerFault.exe
PID 1440 wrote to memory of 1640	1440	7.exe	WerFault.exe
PID 1440 wrote to memory of 1640	1440	7.exe	WerFault.exe
PID 1440 wrote to memory of 1640	1440	7.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\7.exe
"C:\Users\Admin\AppData\Local\Temp\7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 692
2⤵
- Program crash
PID:1640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1440-0-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1440-1-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1440-2-0x0000000000400000-0x00000000004D2000-memory.dmp

Filesize
840KB

Download