d1d6d688c530ecfc93da7cdf372b63a928747c85498669b519d1ac0dd1ec691e | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 07:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

130865cc70a14aae222de6d9a2f882de.exe
Size

835KB
MD5

130865cc70a14aae222de6d9a2f882de
SHA1

b12c29bdce09482f1c4175507c39ea627323a79c
SHA256

d1d6d688c530ecfc93da7cdf372b63a928747c85498669b519d1ac0dd1ec691e
SHA512

b7741e56db0db5fb33efa0964a3c25b03c0c09dbe99acc80e5b7c454d96ae790a5f66c12d02dce131843cd803f10f558ad965e0950a4b983270f47675e612467
SSDEEP

24576:pYOArtsJZ1vktezSj3sK31bxlS2XQNmtHpXG:p1JZ1vkteEPxw2XWmxE

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1936	1888	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 1936	1888	130865cc70a14aae222de6d9a2f882de.exe	28
PID 1888 wrote to memory of 1936	1888	130865cc70a14aae222de6d9a2f882de.exe	28
PID 1888 wrote to memory of 1936	1888	130865cc70a14aae222de6d9a2f882de.exe	28
PID 1888 wrote to memory of 1936	1888	130865cc70a14aae222de6d9a2f882de.exe	28

C:\Users\Admin\AppData\Local\Temp\130865cc70a14aae222de6d9a2f882de.exe
"C:\Users\Admin\AppData\Local\Temp\130865cc70a14aae222de6d9a2f882de.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 108
  2⤵
  - Program crash
  PID:1936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1888-0-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download