2ad8fd535175e6222b50d28ee4a9cd9d02166ef94592822d950138ce5ec937e2 | Triage

Analysis

max time kernel
84s
max time network
139s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 13:48

Sharing

Report Analysis Logs

General

Target

fifa14最新转会补丁.exe
Size

252KB
MD5

95bd21e090d619be1688fb893db3cea1
SHA1

51ebb2b8e54305ecdff2b700d3091dc103da00e7
SHA256

fd252b6504ee55166c98f403dd12959ef34b9d8834e43e807bd70e717c61b9ac
SHA512

93aaa77eb0d295d7c362bb94bae1a0a570430e5b9a4dfff24cf03477274cb93445cdb4f4f0af72af400ac26eccdbfc392aa7dbf0518dd1d4bcd428c684408589
SSDEEP

3072:Nr9KKtUStQJeWIaidfO5+DHkSu0iyhb3xfBTdWISictNJKsEiuBWdWZ:NQKtUoOeWIai9DzM07nx6ijTaY

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1484 856 WerFault.exe fifa14最新转会补丁.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

fifa14最新转会补丁.exe

pid process

856 fifa14最新转会补丁.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

fifa14最新转会补丁.exe

pid process

856 fifa14最新转会补丁.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

fifa14最新转会补丁.exe

description	pid	process	target process
PID 856 wrote to memory of 1484	856	fifa14最新转会补丁.exe	WerFault.exe
PID 856 wrote to memory of 1484	856	fifa14最新转会补丁.exe	WerFault.exe
PID 856 wrote to memory of 1484	856	fifa14最新转会补丁.exe	WerFault.exe
PID 856 wrote to memory of 1484	856	fifa14最新转会补丁.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\fifa14最新转会补丁.exe
"C:\Users\Admin\AppData\Local\Temp\fifa14最新转会补丁.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 688
2⤵
- Program crash
PID:1484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/856-54-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download
memory/1484-55-0x0000000000000000-mapping.dmp

Download