c3a9ab0fbf5cbbec8e2c28a168d8f0c485f6cfa9fddd046c94f4704453ee85ee | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 04:44

Sharing

Report Analysis Logs

General

Target

f7a5c03e582fc4a5034da5fa422a0f6c.exe
Size

525KB
MD5

f7a5c03e582fc4a5034da5fa422a0f6c
SHA1

3425c4a4dbe5f82ca89bf9f3642132dbee5dd30c
SHA256

c3a9ab0fbf5cbbec8e2c28a168d8f0c485f6cfa9fddd046c94f4704453ee85ee
SHA512

6b4b198910cad2417aa8c2447d18260abcd096218001f39fb855f02d27cc44a512bf3bec04928467592a2651a6d82c9e8d8eae81b6269133aa7ba3bac749a09d
SSDEEP

12288:VExdRcut5khzisOG3eD8zN4mbANhSfmP5xbS8Ejv:VEKutkp3J/bWhTXbSv

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2208	1196	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 2208	1196	f7a5c03e582fc4a5034da5fa422a0f6c.exe	28
PID 1196 wrote to memory of 2208	1196	f7a5c03e582fc4a5034da5fa422a0f6c.exe	28
PID 1196 wrote to memory of 2208	1196	f7a5c03e582fc4a5034da5fa422a0f6c.exe	28
PID 1196 wrote to memory of 2208	1196	f7a5c03e582fc4a5034da5fa422a0f6c.exe	28

C:\Users\Admin\AppData\Local\Temp\f7a5c03e582fc4a5034da5fa422a0f6c.exe
"C:\Users\Admin\AppData\Local\Temp\f7a5c03e582fc4a5034da5fa422a0f6c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 68
  2⤵
  - Program crash
  PID:2208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1196-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download