ca1906c0038d784d0ae122797eb5a2c359aeabd142efa34f709c229bec4cd3cc | Triage

Analysis

max time kernel
39s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
31/10/2022, 05:03

Sharing

Report Analysis Logs

General

Target

L2NPC/L2NPC.exe
Size

3.0MB
MD5

600a18faebf9f776e6da00130c6c158c
SHA1

c1a7ca76a50dea5938615ae247aba2bffe8c3740
SHA256

70ca305182907b39e56373a6ef7d43adbb668e86983afd1b851a5640954950ca
SHA512

0f47ea1f15e43a5bb41169e8032de8d3e58e444860fb7eebb45bc496b403e1000863241ad89dfe5e5347cdb12a5ae013ee0173e69b0bc26e79a8af7d9929b59b
SSDEEP

49152:y8kv1/vPS8dBzeuKsmri+wnbQLkVlRI4V2RaJLSoRkxjUzg+p9wr:+pBRnwJUzg+p9

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1172	1264	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 1172	1264	L2NPC.exe	28
PID 1264 wrote to memory of 1172	1264	L2NPC.exe	28
PID 1264 wrote to memory of 1172	1264	L2NPC.exe	28

C:\Users\Admin\AppData\Local\Temp\L2NPC\L2NPC.exe
"C:\Users\Admin\AppData\Local\Temp\L2NPC\L2NPC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1264 -s 216
  2⤵
  - Program crash
  PID:1172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads