7d185f7d580ca1574e1e5065e1be236ae7023a4cfedde087cc917bfc9e47655a | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23-07-2024 10:53

Sharing

Report Analysis Logs

General

Target

55ad3d622726d9e0ee3b6ac78186b8a9.exe
Size

835KB
MD5

55ad3d622726d9e0ee3b6ac78186b8a9
SHA1

8ddb7b17b4cf13213274ec6c9975c5386341964c
SHA256

7d185f7d580ca1574e1e5065e1be236ae7023a4cfedde087cc917bfc9e47655a
SHA512

2bccc058a8ac34a92a4afa68abe2b2c886fa369b5dbf9cb6d6c40dff3c83ec5bd3a22100e53b9aa7fc1e766d980bbf5f3b30e1d9b348fca1ec88e841bba8bbe2
SSDEEP

24576:3tWArtsJhlnUdW5arSUK31asdS+QC/c26Dp:3OJhlnUdWajs4+QCpkp

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1604	2576	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 1604	2576	55ad3d622726d9e0ee3b6ac78186b8a9.exe	30
PID 2576 wrote to memory of 1604	2576	55ad3d622726d9e0ee3b6ac78186b8a9.exe	30
PID 2576 wrote to memory of 1604	2576	55ad3d622726d9e0ee3b6ac78186b8a9.exe	30
PID 2576 wrote to memory of 1604	2576	55ad3d622726d9e0ee3b6ac78186b8a9.exe	30

C:\Users\Admin\AppData\Local\Temp\55ad3d622726d9e0ee3b6ac78186b8a9.exe
"C:\Users\Admin\AppData\Local\Temp\55ad3d622726d9e0ee3b6ac78186b8a9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 108
  2⤵
  - Program crash
  PID:1604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2576-0-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download