5fedb45dfc3128ab5d473a52506b5ad146442c266ae80e2050321d3c9e07b9ee | Triage

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

CardMaster/Crack.exe
Size

1.3MB
MD5

072cc5e9650a8bb147769243e316684d
SHA1

cfc73b64ddc0d0626977e6b75ce6654f6a211391
SHA256

fca968b5eca5700afac0b374f45bbbe2e5c9e6d4075a07e61cc93276b7cfcbb6
SHA512

51893180745eab07fa7d92aac6b83c3a56276af411f348576f9c70feddb28cd351b9f8294325175270c8fa3959f7ddda99e416a4d96413391c888121eebb505b
SSDEEP

24576:h9Uu98JMHGcaXtAjGSgimdxu61Gfrowl:0pcaitHmru61EoQ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
984	1900	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 984	1900	Crack.exe	27
PID 1900 wrote to memory of 984	1900	Crack.exe	27
PID 1900 wrote to memory of 984	1900	Crack.exe	27
PID 1900 wrote to memory of 984	1900	Crack.exe	27

C:\Users\Admin\AppData\Local\Temp\CardMaster\Crack.exe
"C:\Users\Admin\AppData\Local\Temp\CardMaster\Crack.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 460
  2⤵
  - Program crash
  PID:984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1900-54-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/1900-56-0x0000000000400000-0x0000000000548000-memory.dmp

Filesize
1.3MB

Download