ea88a11143a80d2ecf2472a5d73e11ae28c3dc58708594c70af1b0da8d2d21f8 | Triage

Analysis

max time kernel
56s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/10/2022, 05:36

Sharing

Report Analysis Logs

General

Target

Wire Copy.exe
Size

857KB
MD5

f38a63ac35e32d6910e71680df481b5e
SHA1

d1eee2825b46411d3997b568691c951eb80fe6c7
SHA256

ea88a11143a80d2ecf2472a5d73e11ae28c3dc58708594c70af1b0da8d2d21f8
SHA512

4ae968a329d279a69d285a6b1ebd10c0bc74e47b7559699f5b85b469726e0f6341365a93769e3f204920df08312cb8a7c7bb1764209cfa3d83c220616722ddf1
SSDEEP

12288:mA7KPA5/UpENPRjWUjxhxosbDkLg+ZsNHzqjJ5nXuc1GC:8a/U6tRjZqsbYg+uHOjrXucI

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1532	2016	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1532	2016	Wire Copy.exe	27
PID 2016 wrote to memory of 1532	2016	Wire Copy.exe	27
PID 2016 wrote to memory of 1532	2016	Wire Copy.exe	27
PID 2016 wrote to memory of 1532	2016	Wire Copy.exe	27

C:\Users\Admin\AppData\Local\Temp\Wire Copy.exe
"C:\Users\Admin\AppData\Local\Temp\Wire Copy.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 680
  2⤵
  - Program crash
  PID:1532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2016-54-0x0000000000CD0000-0x0000000000DAC000-memory.dmp

Filesize
880KB

Download
memory/2016-55-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/2016-56-0x00000000003A0000-0x00000000003C0000-memory.dmp

Filesize
128KB

Download