27784f24a8d0b693b96e57355c6eab3e56f2b6909cf74154393fdb6ee9ac6d17 | Triage

Analysis

max time kernel
20s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 18:37

Sharing

Report Analysis Logs

General

Target

冰封免费版(请关闭杀毒软件下载)/ty.exe
Size

169KB
MD5

04ab3fe511b4a7465c57fc9e7aedcd3d
SHA1

f678150e525de20a58a2766d52846cc70ffcb622
SHA256

81f15689949e602c3413de07cd00d25baab313dc7a05d5fb05b7de04842a616d
SHA512

e4c5048c1ca4e4a355ff0c85932cb6e67c009f85b79189a0214026521a46744dd592cc3a83246c65a974dce67c570c2288be01150671ebc52ae9584bf10fc393
SSDEEP

3072:uP89l9/zuYu3PvTiqTsKfw6H2vPrzDlNM6FHpU9yP7X4kXq2GzT:cmlzmPvjGHvPn53dBX8p

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

ty.exe

pid process

952 ty.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1908 952 WerFault.exe ty.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ty.exe

description	pid	process	target process
PID 952 wrote to memory of 1908	952	ty.exe	WerFault.exe
PID 952 wrote to memory of 1908	952	ty.exe	WerFault.exe
PID 952 wrote to memory of 1908	952	ty.exe	WerFault.exe
PID 952 wrote to memory of 1908	952	ty.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\冰封免费版(请关闭杀毒软件下载)\ty.exe
"C:\Users\Admin\AppData\Local\Temp\冰封免费版(请关闭杀毒软件下载)\ty.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 56
  2⤵
  - Program crash
  PID:1908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/952-54-0x0000000000AA0000-0x0000000000B07000-memory.dmp

Filesize
412KB

Download
memory/952-58-0x0000000000AA0000-0x0000000000B07000-memory.dmp

Filesize
412KB

Download
memory/1908-57-0x0000000000000000-mapping.dmp

Download