Analysis

  • max time kernel
    119s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22/03/2025, 06:15

General

  • Target

    a24432a43960cdb6f6f7f18467006139.exe

  • Size

    6KB

  • MD5

    a24432a43960cdb6f6f7f18467006139

  • SHA1

    fad0c86b81c532ba6bb7b4f03b982bb31c2b346c

  • SHA256

    66d11e312209af785ae2369dd9455e0e18c8600a4516cf83c41b21cea938d912

  • SHA512

    964fc963968c9a9a4ad10f31b7e4b7af64ad0c55056b5dc38197d6e4832914d0f2b95a5929b89461adc42540135a33ff0ba08ddb392e175d81763b33ea88598b

  • SSDEEP

    96:XEp183UrouurLSDgmcKW+XJqT+DhpuzNt:XE/83zuTgmfRqTco

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a24432a43960cdb6f6f7f18467006139.exe
    "C:\Users\Admin\AppData\Local\Temp\a24432a43960cdb6f6f7f18467006139.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:768
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 768 -s 480
      2⤵
        PID:3064

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/768-0-0x000007FEF5683000-0x000007FEF5684000-memory.dmp

      Filesize

      4KB

    • memory/768-1-0x0000000001070000-0x0000000001078000-memory.dmp

      Filesize

      32KB

    • memory/768-2-0x0000000000270000-0x0000000000271000-memory.dmp

      Filesize

      4KB

    • memory/768-3-0x000007FEF5680000-0x000007FEF606C000-memory.dmp

      Filesize

      9.9MB