e1c7d09afcada193579ac21b5e3c3ab9eb710576ebc835358add821ddde3a139 | Triage

Analysis

max time kernel
11s
platform
windows7_x64
resource
win7-20230220-es
resource tags

arch:x64arch:x86image:win7-20230220-eslocale:es-esos:windows7-x64systemwindows
submitted
14/05/2023, 14:54

Sharing

Report Analysis Logs

General

Target

TrainingSlayer.exe
Size

104KB
MD5

85edd39151d85c0c2a0c5f640ff2f44e
SHA1

0a899342f0adca93d82a09c10c0b634db3492781
SHA256

e1c7d09afcada193579ac21b5e3c3ab9eb710576ebc835358add821ddde3a139
SHA512

46c5c4d131de248b7334280e9d0adf5b3659f6eea2e23a33eab94a0253f7d1c567cbaf3a480d8027dd601888a9e62a17bad3c0a9132f2211ed1686ea4f26b76c
SSDEEP

3072:NL3Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:ZQ+IFCumUGekHRvEuO3go9kfnQ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2028	2040	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2028	2040	TrainingSlayer.exe	28
PID 2040 wrote to memory of 2028	2040	TrainingSlayer.exe	28
PID 2040 wrote to memory of 2028	2040	TrainingSlayer.exe	28

C:\Users\Admin\AppData\Local\Temp\TrainingSlayer.exe
"C:\Users\Admin\AppData\Local\Temp\TrainingSlayer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2040 -s 56
  2⤵
  - Program crash
  PID:2028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-54-0x0000000140000000-0x0000000140021000-memory.dmp

Filesize
132KB

Download