0a0c225f0e5ee941a79f2b7701f1285e4975a2859eb4d025d96d9e366e81abb9 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
21-06-2024 22:09

Sharing

Report Analysis Logs

General

Target

not_malware.exe
Size

56KB
MD5

979692cd7fc638beea6e9d68c752f360
SHA1

c511ae4d80aaa281c610190aa13630de61ca714c
SHA256

0a0c225f0e5ee941a79f2b7701f1285e4975a2859eb4d025d96d9e366e81abb9
SHA512

d7b7b6a968e6d7b7f3e7f98decb6b331b08122e491bf0b0dbe243223fb177218a758c34830f20c47f2a799acdd146297ec7f930c2bb4d5c6830ce65c8274ea6d
SSDEEP

768:piN4q1eksgR4SiI+rxQ3rjFrXRRWxXyw/Afy8fIaJ/ZB49j9xOOLd9kvAx0:g4HHerjZX7pLjJKjSO5i

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2976	1660	WerFault.exe	29

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\International	not_malware.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 1660	2072	not_malware.exe	29
PID 2072 wrote to memory of 1660	2072	not_malware.exe	29
PID 2072 wrote to memory of 1660	2072	not_malware.exe	29
PID 2072 wrote to memory of 1660	2072	not_malware.exe	29
PID 2072 wrote to memory of 1660	2072	not_malware.exe	29

C:\Users\Admin\AppData\Local\Temp\not_malware.exe
"C:\Users\Admin\AppData\Local\Temp\not_malware.exe"
1⤵
PID:2372

C:\Users\Admin\AppData\Local\Temp\not_malware.exe
"C:\Users\Admin\AppData\Local\Temp\not_malware.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Users\Admin\AppData\Local\Temp\not_malware.exe
  "C:\Users\Admin\AppData\Local\Temp\not_malware.exe"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1660
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 436
    3⤵
    - Program crash
    PID:2976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads