d55ddbca0b7e23b471cd4e86a771583bbb6d8bd1f1a1bdc64db6431a44ed6cba | Triage

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 06:26

Sharing

Report Analysis Logs

General

Target

5c0fd2907879e3bfc7e88e4f2ffc40f0N.exe
Size

184KB
MD5

5c0fd2907879e3bfc7e88e4f2ffc40f0
SHA1

7f7ff320e427a441baa5ab27bdf32263b317c981
SHA256

d55ddbca0b7e23b471cd4e86a771583bbb6d8bd1f1a1bdc64db6431a44ed6cba
SHA512

00a72a8eefb8c4a4e89d121ca402a657650a087daac100d6b35a451b8ce05dfb96470379d934b07afae53570d3652273cf1350d36b13f0915934ec7fcaa4ecfb
SSDEEP

3072:otPLHSKrYUlPd0AtNUtzWvEnlvnqeviu:otOK110AEz8EnlPqeviu

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
236	2476	WerFault.exe	30

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2476	5c0fd2907879e3bfc7e88e4f2ffc40f0N.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 236	2476	5c0fd2907879e3bfc7e88e4f2ffc40f0N.exe	31
PID 2476 wrote to memory of 236	2476	5c0fd2907879e3bfc7e88e4f2ffc40f0N.exe	31
PID 2476 wrote to memory of 236	2476	5c0fd2907879e3bfc7e88e4f2ffc40f0N.exe	31
PID 2476 wrote to memory of 236	2476	5c0fd2907879e3bfc7e88e4f2ffc40f0N.exe	31

C:\Users\Admin\AppData\Local\Temp\5c0fd2907879e3bfc7e88e4f2ffc40f0N.exe
"C:\Users\Admin\AppData\Local\Temp\5c0fd2907879e3bfc7e88e4f2ffc40f0N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 240
  2⤵
  - Program crash
  PID:236

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads