93665180bfdd2577dbbebec7f979127aa6360d75c2b14bd97599ebb40da9e166 | Triage

Analysis

max time kernel
112s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 08:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8c42508a381a6c9dad829d3e956eaa60N.exe
Size

57KB
MD5

8c42508a381a6c9dad829d3e956eaa60
SHA1

724f53873135adc7598313d66a2e9a62c9ab41d4
SHA256

93665180bfdd2577dbbebec7f979127aa6360d75c2b14bd97599ebb40da9e166
SHA512

74d8bb02b501f4689c302d1b2c6d103804017a2824d702ed6cec40770307e6a227b599fd1999daf7b60b6fc70f7c11fcba4f6854880a6652ff4dffbd3262d002
SSDEEP

1536:58hRaRUkdgunPGlgJ/3yxLS08hJ/5HJSGWQxF:GhRaqkdKuJKJSPzaGWQv

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1684	2024	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 1684	2024	8c42508a381a6c9dad829d3e956eaa60N.exe	30
PID 2024 wrote to memory of 1684	2024	8c42508a381a6c9dad829d3e956eaa60N.exe	30
PID 2024 wrote to memory of 1684	2024	8c42508a381a6c9dad829d3e956eaa60N.exe	30
PID 2024 wrote to memory of 1684	2024	8c42508a381a6c9dad829d3e956eaa60N.exe	30

C:\Users\Admin\AppData\Local\Temp\8c42508a381a6c9dad829d3e956eaa60N.exe
"C:\Users\Admin\AppData\Local\Temp\8c42508a381a6c9dad829d3e956eaa60N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 148
  2⤵
  - Program crash
  PID:1684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2024-0-0x0000000000400000-0x000000000042A397-memory.dmp

Filesize
168KB

Download
memory/2024-1-0x0000000000400000-0x000000000042A397-memory.dmp

Filesize
168KB

Download