807296a17cb6d5058fd15602d7ea0826cfd4fa3ea25294242f9f6ff40c2a5f5d | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 16:19

Sharing

Report Analysis Logs

General

Target

out.exe
Size

236KB
MD5

683cff71c4f613013c35e5f98772f9c4
SHA1

a3f11854831f911057f022ab26d9057f653160ce
SHA256

2d0f11fb55d73b41391f6e3356e986ec5907c4e88a7110aa948574e12e955b57
SHA512

c7bdce68be682b3c281469b0d231b314965a4a131d2f68f0c8daa1cd2d266e0027b210020f9845bab12968896f958892f85a73c50d2fcbed16fa1f5a78ba5e05
SSDEEP

1536:Xy3d2P6H/meQ/PG6YFyfRsrHqZ+dx3t4SkHokrdRncohxC32B:XPyueQ/PG6YFyfRoqZ6iSEhrPn

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1992 1372 WerFault.exe out.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

out.exe

description	pid	process	target process
PID 1372 wrote to memory of 1992	1372	out.exe	WerFault.exe
PID 1372 wrote to memory of 1992	1372	out.exe	WerFault.exe
PID 1372 wrote to memory of 1992	1372	out.exe	WerFault.exe
PID 1372 wrote to memory of 1992	1372	out.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\out.exe
"C:\Users\Admin\AppData\Local\Temp\out.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 36
  2⤵
  - Program crash
  PID:1992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads