22431a11497a177fcb5aa362c7a7a7eb21e1c9a27015233f750a24abcbb730cf | Triage

Analysis

max time kernel
32s
max time network
35s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
27/03/2023, 17:39

Sharing

Report Analysis Logs

General

Target

UuuClient.exe
Size

446KB
MD5

f27ece59b091a854a1a1d94eff3f27ae
SHA1

e5b0260fafccf5c46cd066d70e2f608a39036b88
SHA256

22431a11497a177fcb5aa362c7a7a7eb21e1c9a27015233f750a24abcbb730cf
SHA512

c06be34e69f9fdc92cb4c98d3c60cd022f779f7fb155fb4f26eb96df50b0433bf8e25d904427f68ce334ef1076053c336753aba5cefac2273673c5187369d646
SSDEEP

3072:4r7fUiujm4LRk2sdVCx42LNtu2ykNARuyuY4YrMR2nR1kwGZPWMaQiDr:mRIUjCxE9kNAcyRMPRZ+hD

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2024	2040	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2024	2040	UuuClient.exe	28
PID 2040 wrote to memory of 2024	2040	UuuClient.exe	28
PID 2040 wrote to memory of 2024	2040	UuuClient.exe	28

C:\Users\Admin\AppData\Local\Temp\UuuClient.exe
"C:\Users\Admin\AppData\Local\Temp\UuuClient.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2040 -s 612
  2⤵
  - Program crash
  PID:2024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-54-0x0000000000280000-0x00000000002F4000-memory.dmp

Filesize
464KB

Download
memory/2040-55-0x000000001B010000-0x000000001B090000-memory.dmp

Filesize
512KB

Download
memory/2040-56-0x000000001B010000-0x000000001B090000-memory.dmp

Filesize
512KB

Download