ae0d9681cc81177d2fa976060a38ad7cc819b363da0192bca2620f6f285c47cc | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
02-06-2024 09:43

Sharing

Report Analysis Logs

General

Target

LogViewer.exe
Size

752KB
MD5

d7a2ddd47f3447b8b98dd50e3550d049
SHA1

fcb563f3da07524f16bd243102bac40a0d359b26
SHA256

f592b80ef89b01f19fa17cbaa918a7f80ca0fdfbe09234ca84b613756eff392a
SHA512

22076abbd77fb717bbd23735cd23682b3ee6f2a14357536059b903a9e9791809d09f88716fa11e17eb02379729705ab6954197280ebecc82bc2c226f356e1991
SSDEEP

6144:PKHprMS9Vyg6Xl1gNP3RW9Qj4rP47WsCvqZ6ihO80oHpvB:PurMS9VFq2BW9Qj4MeB80oHL

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

LogViewer.exe

description	pid	process	target process
PID 2888 wrote to memory of 2952	2888	LogViewer.exe	WerFault.exe
PID 2888 wrote to memory of 2952	2888	LogViewer.exe	WerFault.exe
PID 2888 wrote to memory of 2952	2888	LogViewer.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\LogViewer.exe
"C:\Users\Admin\AppData\Local\Temp\LogViewer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2888

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2888 -s 240
2⤵
PID:2952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads