f6e85a09d34fee8569e913af2a11addf2a6a640e22f2a92e691576bbc89de411 | Triage

Analysis

max time kernel
20s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
18/03/2023, 00:24

Sharing

Report Analysis Logs

General

Target

Undertale/UNDERTALE.exe
Size

3.6MB
MD5

93d87952773a2bb59a8667d0bc06c2c0
SHA1

480c87f42e8ecbcde1104f4a61de5dee6a9cb3c5
SHA256

9ec41f5094544c938fc075f5506c089d0c1e11fb93afba79a196981bef81d19b
SHA512

d9fce47e5c037e4954437c95abea6959e39c91d0bcd596f1c3267e5c09e5a0defade4c63617609b5386879bcae06e3c60e909fcf2476e250bc960eea0c2d1c6d
SSDEEP

49152:LKmEDcfY7y7tinhmShHrfh/mX2KiKwmFT7MvTyA:y7K6HrfdmX2KiUFT7M2A

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1200	824	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 1200	824	UNDERTALE.exe	28
PID 824 wrote to memory of 1200	824	UNDERTALE.exe	28
PID 824 wrote to memory of 1200	824	UNDERTALE.exe	28
PID 824 wrote to memory of 1200	824	UNDERTALE.exe	28

C:\Users\Admin\AppData\Local\Temp\Undertale\UNDERTALE.exe
"C:\Users\Admin\AppData\Local\Temp\Undertale\UNDERTALE.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:824
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 824 -s 420
  2⤵
  - Program crash
  PID:1200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads