Analysis

  • max time kernel
    46s
  • max time network
    50s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    02-11-2022 21:57

General

  • Target

    1480-74-0x0000000000400000-0x000000000042F000-memory.exe

  • Size

    188KB

  • MD5

    f9aa748de76aada91fc9b71ad0a55e68

  • SHA1

    98f235346c57b80f2b31d5a42c91f08770f87622

  • SHA256

    c0688f5e918f5a362033c226db17d7bca37a0835f8bc9acdcc5b5ca57be493e5

  • SHA512

    ec44de1d9fdc867597ef782cc6a32f3daead9aa7648bfff72832514e9fe3c7d0a3aa2d76cbd6df498ecb7efffe73d6d65904a2cc37c195ba51a7c206ab230e45

  • SSDEEP

    3072:Iaf56jYo/wrnBGdNWLGmS35FDhRNvD5XVlmmMM6o30KjM6rQOZlNjW/8nu:kYZkdWG7Zh/b5llm3M6o307W1bjfnu

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1480-74-0x0000000000400000-0x000000000042F000-memory.exe
    "C:\Users\Admin\AppData\Local\Temp\1480-74-0x0000000000400000-0x000000000042F000-memory.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1444
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 36
      2⤵
      • Program crash
      PID:1948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1948-54-0x0000000000000000-mapping.dmp