75cd44478160b963ef43739e6f1f7105be4e9fbf7627bbdd22103d9eb38b5595 | Triage

Analysis

max time kernel
12s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13/04/2023, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Attack On Survey Corps.exe
Size

102KB
MD5

a9455ea71cbd1cd82584b74e3db76616
SHA1

da8f0b133d4839e52eb79223775d099063b2ea64
SHA256

75cd44478160b963ef43739e6f1f7105be4e9fbf7627bbdd22103d9eb38b5595
SHA512

cafae046bc8a173c627427adc35e7b2b3b8264f63da9ee416c24c9ba46307e39659b73304fdf4e4a87a544b8a3865e12f12bfb6a164ac1e785f4062f21e6b98b
SSDEEP

3072:43Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:2Q+IFCumUGekHRvEuO3go9kfnQ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
912	1712	WerFault.exe	26

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 912	1712	Attack On Survey Corps.exe	27
PID 1712 wrote to memory of 912	1712	Attack On Survey Corps.exe	27
PID 1712 wrote to memory of 912	1712	Attack On Survey Corps.exe	27

C:\Users\Admin\AppData\Local\Temp\Attack On Survey Corps.exe
"C:\Users\Admin\AppData\Local\Temp\Attack On Survey Corps.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1712 -s 56
  2⤵
  - Program crash
  PID:912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads