e6a456f5d3a830b834f12b5587ee9e7e82318bde870d712d4ee78742d4e8c0fc | Triage

Analysis

max time kernel
38s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
31/01/2023, 10:55

Sharing

Report Analysis Logs

General

Target

2022年11月.exe
Size

6.8MB
MD5

f723c9822a123bc1635a5cd946d4a6bd
SHA1

0ca28a943d4253797f530055cb71845a9b350ad8
SHA256

f94e5b58beebf14dca831d2c2660be272dd1538033bf0c12521eaea1ba7e7674
SHA512

7e1b9adc09dca870388cc899c3f69c607ef1d3569d3d4356acbf280dab9a25373f2f9f718d25616372aaaee182f7d08a57da7839ee020721098202cc3334114e
SSDEEP

98304:DEJN9Q/rk084xBKArRFAIxIBCWxy6fTiYjkAMsMG0NrL34d:Dl/k4KArRAxxX4sMff0

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1048	2036	WerFault.exe	26

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	2022年11月.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	2022年11月.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1048	2036	2022年11月.exe	27
PID 2036 wrote to memory of 1048	2036	2022年11月.exe	27
PID 2036 wrote to memory of 1048	2036	2022年11月.exe	27
PID 2036 wrote to memory of 1048	2036	2022年11月.exe	27

C:\Users\Admin\AppData\Local\Temp\2022年11月.exe
"C:\Users\Admin\AppData\Local\Temp\2022年11月.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 160
  2⤵
  - Program crash
  PID:1048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads