f2e8d9ed420790f4d8599ed37f4add1ca2d91fe46a0b610c4099bad58e9fe621 | Triage

Resubmissions

14/03/2023, 18:56

230314-xlvfxsbb6t 3

14/03/2023, 18:48

230314-xfr4lsbb31 3

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14/03/2023, 18:56

Sharing

Report Analysis Logs

General

Target

XWorm V3.1.exe
Size

7.2MB
MD5

6ac5dddbfb5a304c842c4bd5987384cc
SHA1

fdfd83d17be668aff5059fb31d510644db80dcf5
SHA256

f2e8d9ed420790f4d8599ed37f4add1ca2d91fe46a0b610c4099bad58e9fe621
SHA512

2f1efbcdf2b263645411e505f3849469702082b46e34bc70eb501f8f9f838193ab8ba06fa107d339b7c5081e878e3d34b60d94b7ade0c0da5023a56a5eee9949
SSDEEP

196608:TLQ6B/XKUDz9NoUXJzUWi7MYjBVvo5/UV:fFlaU/9NZXJZinjB9oxg

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2028	1204	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 2028	1204	XWorm V3.1.exe	28
PID 1204 wrote to memory of 2028	1204	XWorm V3.1.exe	28
PID 1204 wrote to memory of 2028	1204	XWorm V3.1.exe	28

C:\Users\Admin\AppData\Local\Temp\XWorm V3.1.exe
"C:\Users\Admin\AppData\Local\Temp\XWorm V3.1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1204 -s 696
  2⤵
  - Program crash
  PID:2028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1204-54-0x00000000012A0000-0x00000000019D6000-memory.dmp

Filesize
7.2MB

Download
memory/1204-55-0x000000001B4F0000-0x000000001B570000-memory.dmp

Filesize
512KB

Download