011c9ce83f0880e107c63bd280aa636bb84dc2e61b57269599609728e845a8c1 | Triage

Analysis

max time kernel
26s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13/06/2023, 15:34

Sharing

Report Analysis Logs

General

Target

Terraria.exe
Size

19.5MB
MD5

8ad451f8ff1d95de4cdb36302094af90
SHA1

4d473e1a4d70009ca856dd0a797b70c36f7424e1
SHA256

011c9ce83f0880e107c63bd280aa636bb84dc2e61b57269599609728e845a8c1
SHA512

1e12d11752862ce6370dc3f9ca9aa6ca16aab1b9e512cbf9a7227f6fde3118134d81b39b7ba4c109d98f414ec17c46863b44439253e923cadf3ec3640a1890ee
SSDEEP

98304:9EjCQCovssQsmEEbVxh3OmOP3+ODZt55udu:yjCQRssQsmXxYP3+ODZtSdu

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1936	1984	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 1936	1984	Terraria.exe	28
PID 1984 wrote to memory of 1936	1984	Terraria.exe	28
PID 1984 wrote to memory of 1936	1984	Terraria.exe	28
PID 1984 wrote to memory of 1936	1984	Terraria.exe	28

C:\Users\Admin\AppData\Local\Temp\Terraria.exe
"C:\Users\Admin\AppData\Local\Temp\Terraria.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 612
  2⤵
  - Program crash
  PID:1936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1984-54-0x0000000001350000-0x00000000026D0000-memory.dmp

Filesize
19.5MB

Download
memory/1984-55-0x0000000000480000-0x00000000004AE000-memory.dmp

Filesize
184KB

Download