df3a364fb96feac40475962b1c6f9c87445191b9b4123826aa9240439c0f0fd0 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-06-2024 10:33

Sharing

Report Analysis Logs

General

Target

Adobe_Activator.exe
Size

11.3MB
MD5

31432ef1c55f5fe1a20c7dd894be5e7e
SHA1

238f387160c4b333817fb1e83544362491bd6d16
SHA256

df3a364fb96feac40475962b1c6f9c87445191b9b4123826aa9240439c0f0fd0
SHA512

02362e6267cda7b042ce4d6fcbe09286cb40f401e22d78d2d9353b04f36f3296a8c65ac417fac083f2c8b9bb48bdb34a3f72ac66e0f96b46a096d6e3ed20f22d
SSDEEP

196608:zQAOR5GAycy+CzaayyCV4MCnycqvrCKZ8UFR5:kxRKZxaayyCrey7vrD7FR

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1700 1196 WerFault.exe Adobe_Activator.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Adobe_Activator.exe

description	pid	process	target process
PID 1196 wrote to memory of 1700	1196	Adobe_Activator.exe	WerFault.exe
PID 1196 wrote to memory of 1700	1196	Adobe_Activator.exe	WerFault.exe
PID 1196 wrote to memory of 1700	1196	Adobe_Activator.exe	WerFault.exe
PID 1196 wrote to memory of 1700	1196	Adobe_Activator.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Adobe_Activator.exe
"C:\Users\Admin\AppData\Local\Temp\Adobe_Activator.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 556
2⤵
- Program crash
PID:1700

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1196-0-0x000000007464E000-0x000000007464F000-memory.dmp

Filesize
4KB

Download
memory/1196-1-0x00000000011A0000-0x0000000001CEC000-memory.dmp

Filesize
11.3MB

Download
memory/1196-2-0x000000007464E000-0x000000007464F000-memory.dmp

Filesize
4KB

Download