6ea5dc63bda788cd58bcbc5d9c736f7ba1d01371a9d05c53134616c2776c6314 | Triage

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 23:35

Sharing

Report Analysis Logs

General

Target

crypted.exe
Size

529KB
MD5

efb9f7b4e6703ad5d5b179992a6c44f8
SHA1

6f51ff5a147570a141ec8ce662501c21ff8b3530
SHA256

6ea5dc63bda788cd58bcbc5d9c736f7ba1d01371a9d05c53134616c2776c6314
SHA512

389ea1f3881434c7aabad6c9ff4827cc595afb326d978de9dbf0cfd1f80d96f9d242e11da8025970f1cf594382f01b1c86e53476d5e7896ed802dd9c018d6dc0
SSDEEP

12288:yJ8TOT7hr3MBm3CCkf3HHhBjM14MqLNyjK3h//8wr+kv:yEU7hDMg3bkf3nbjZR//8kT

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3056 3032 WerFault.exe crypted.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

crypted.exe

description	pid	process	target process
PID 3032 wrote to memory of 3056	3032	crypted.exe	WerFault.exe
PID 3032 wrote to memory of 3056	3032	crypted.exe	WerFault.exe
PID 3032 wrote to memory of 3056	3032	crypted.exe	WerFault.exe
PID 3032 wrote to memory of 3056	3032	crypted.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\crypted.exe
"C:\Users\Admin\AppData\Local\Temp\crypted.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 96
2⤵
- Program crash
PID:3056

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3032-0-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download