Analysis

  • max time kernel
    42s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    07-12-2022 15:54

General

  • Target

    1552-66-0x0000000000400000-0x000000000042E000-memory.exe

  • Size

    184KB

  • MD5

    99296bc3b20066fcb6ee726e66e9c5cd

  • SHA1

    4721eb30d34306accdea6a8613ecab42fe66214e

  • SHA256

    2e9f7ed0596646663c551ba9f7fcca8d403824ec87f27573711c405554f3d531

  • SHA512

    67c336d07d12afcab5e073a5e1ad0cde904404ed5ec957d3855ed8ef08d61e4f610340b3a405796a0d85e8af0b0bc209018dbcd9f35f54ade1ef4255a62a3a91

  • SSDEEP

    3072:mhFG78GZE1U0hWrBoM1pWcIoYwZF77+KpwcJoz8aCoqM60mmT2fuHTbUPUh:mhFLGZE1U0hIL11IgF7vK+E8aJqMom6u

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1552-66-0x0000000000400000-0x000000000042E000-memory.exe
    "C:\Users\Admin\AppData\Local\Temp\1552-66-0x0000000000400000-0x000000000042E000-memory.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:832
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 832 -s 36
      2⤵
      • Program crash
      PID:1640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1640-54-0x0000000000000000-mapping.dmp