0c9d401e9b393d2e7e2e3c727ba6e3e83cde22df260731879a4e5b0350929574 | Triage

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 17:39

Sharing

Report Analysis Logs

General

Target

file.exe
Size

355KB
MD5

d79b788762c6435ae9f599743f9f482d
SHA1

4d96933a654c426776b30b57b49227e812b3d231
SHA256

0c9d401e9b393d2e7e2e3c727ba6e3e83cde22df260731879a4e5b0350929574
SHA512

e6e3a3be1c171b38a9b167291d2f875c169c04b0aefe7425092301cdb694c2c052fdc30e770634634c82ca3cca76507e20d0aff1ea6db9076299e10935bb39f9
SSDEEP

6144:hKrTm/Wop3oiUklM540oF1zTuoZxFrI/l2k9Joup1JgHEa23sw6ac:8rTm/WohfdFNhhGpIOcYc

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1676	1612	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 1676	1612	file.exe	28
PID 1612 wrote to memory of 1676	1612	file.exe	28
PID 1612 wrote to memory of 1676	1612	file.exe	28
PID 1612 wrote to memory of 1676	1612	file.exe	28

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 48
  2⤵
  - Program crash
  PID:1676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1612-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1612-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download