f920c113b680ae89ec650603e52dff1480f6879699a7d2af4f9e736c3f06e6a1 | Triage

Analysis

max time kernel
140s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
07-07-2024 04:03

Sharing

Report Analysis Logs

General

Target

3d7dacbf20214826dc5fcab0bf119fc0N.exe
Size

1.4MB
MD5

3d7dacbf20214826dc5fcab0bf119fc0
SHA1

0bb808a3b4d6a471459c3feba380a3ba16a5a9c4
SHA256

f920c113b680ae89ec650603e52dff1480f6879699a7d2af4f9e736c3f06e6a1
SHA512

767da56de6ac3678466791d2fd3268c72f3020e4eb3d7784d1e9f15af4274ba461d70e5c49f4a7b26b387f29fa61cc8997091924bbf217d2222bdef44036a216
SSDEEP

24576:0en3UPh+BnqC6u2cbMXuoAY3c/pm4oHMbX3argJvi4:0o1RummzsbXdNi

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2264	2820	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 2264	2820	3d7dacbf20214826dc5fcab0bf119fc0N.exe	28
PID 2820 wrote to memory of 2264	2820	3d7dacbf20214826dc5fcab0bf119fc0N.exe	28
PID 2820 wrote to memory of 2264	2820	3d7dacbf20214826dc5fcab0bf119fc0N.exe	28
PID 2820 wrote to memory of 2264	2820	3d7dacbf20214826dc5fcab0bf119fc0N.exe	28

C:\Users\Admin\AppData\Local\Temp\3d7dacbf20214826dc5fcab0bf119fc0N.exe
"C:\Users\Admin\AppData\Local\Temp\3d7dacbf20214826dc5fcab0bf119fc0N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 292
  2⤵
  - Program crash
  PID:2264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2820-0-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2820-1-0x0000000000400000-0x0000000000578000-memory.dmp

Filesize
1.5MB

Download
memory/2820-3-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download