8152c15bff08fde5e757a4dca8cf5fbae797401f3f1053c6c8aa05be604eac90 | Triage

Analysis

max time kernel
52s
max time network
45s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
22/11/2022, 06:25

Sharing

Report Analysis Logs

General

Target

小鸡接码用户端_v26.exe
Size

111KB
MD5

e2980d02b76b25d6d47faa917ab247a2
SHA1

e4a8ef9444b1567accb9f32c2d68d9bae0a19198
SHA256

8152c15bff08fde5e757a4dca8cf5fbae797401f3f1053c6c8aa05be604eac90
SHA512

8cfbbb6181ed64a08932401276a3298f9fe667c250e17798c12db165a964aea60f380026ab7c01bb246d2e622d22ec3dd06a1e0427ff9a297a8abebd1fca2e54
SSDEEP

3072:DmrArNnwguJb/TugckYRJn8c5Lng63CH7yGgPYmwoYKo:yEN/uJb/ZYRJ8cdng6SyGgrwn

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
560	1516	WerFault.exe	8

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 560	1516	小鸡接码用户端_v26.exe	30
PID 1516 wrote to memory of 560	1516	小鸡接码用户端_v26.exe	30
PID 1516 wrote to memory of 560	1516	小鸡接码用户端_v26.exe	30

C:\Users\Admin\AppData\Local\Temp\小鸡接码用户端_v26.exe
"C:\Users\Admin\AppData\Local\Temp\小鸡接码用户端_v26.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1516 -s 196
  2⤵
  - Program crash
  PID:560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1516-54-0x000007FEFBE41000-0x000007FEFBE43000-memory.dmp

Filesize
8KB

Download