80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ce | Triage

Resubmissions

03/01/2023, 09:24

230103-ldevqaba34 10

26/07/2022, 22:27

220726-2dh55sada7 10

26/07/2022, 22:25

220726-2b8b9aehbk 3

11/07/2022, 16:41

220711-t7lt5adch5 10

Analysis

max time kernel
77s
max time network
45s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
26/07/2022, 22:25

Sharing

Report Analysis Logs

General

Target

732022_lbblack.exe
Size

162KB
MD5

38745539b71cf201bb502437f891d799
SHA1

f2a72bee623659d3ba16b365024020868246d901
SHA256

80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ce
SHA512

772e76757069c3375cf1ffd659ff03f47f2d4becae61a852adbc27ae467551210d8832994f944c05fccc8486a8a88322021c94217a8bd962c2459af41067132b

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2012	872	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 872 wrote to memory of 2012	872	732022_lbblack.exe	27
PID 872 wrote to memory of 2012	872	732022_lbblack.exe	27
PID 872 wrote to memory of 2012	872	732022_lbblack.exe	27
PID 872 wrote to memory of 2012	872	732022_lbblack.exe	27

C:\Users\Admin\AppData\Local\Temp\732022_lbblack.exe
"C:\Users\Admin\AppData\Local\Temp\732022_lbblack.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 872 -s 88
  2⤵
  - Program crash
  PID:2012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/872-55-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download