c73eb869d7b9418687295640047937c339a57149116faa99dc383ac87de5c3c5 | Triage

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
08-06-2023 15:14

Sharing

Report Analysis Logs

General

Target

Kingdee.BOS.BuildPackageDownload.Shell.exe
Size

30KB
MD5

31bac396f2259b9eb4df9e3abb7768b7
SHA1

88fbd0a7b8f7878a4050c069bf27f2c52b460e03
SHA256

c73eb869d7b9418687295640047937c339a57149116faa99dc383ac87de5c3c5
SHA512

c190d8ff9e6b67846d3b5c702e00269fb8c810102183b1327daff3aeb57b14bf41adca072e437b856dbebc0eb9a947e8ea219b4f71f77c86b15cc9d701c1a227
SSDEEP

768:YrZ4a4g6XVxQKqWVOkUqxbNw/gk3qWZBK:Y2o6XVxMWVUqxbN+aWDK

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
784	924	WerFault.exe	26

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 784	924	Kingdee.BOS.BuildPackageDownload.Shell.exe	28
PID 924 wrote to memory of 784	924	Kingdee.BOS.BuildPackageDownload.Shell.exe	28
PID 924 wrote to memory of 784	924	Kingdee.BOS.BuildPackageDownload.Shell.exe	28

C:\Users\Admin\AppData\Local\Temp\Kingdee.BOS.BuildPackageDownload.Shell.exe
"C:\Users\Admin\AppData\Local\Temp\Kingdee.BOS.BuildPackageDownload.Shell.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:924
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 924 -s 524
  2⤵
  - Program crash
  PID:784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/924-54-0x0000000000B30000-0x0000000000B3E000-memory.dmp

Filesize
56KB

Download