1a69fa239504e00c75f585740956581442c9bc32eb45ac65e0023aa872f387e3 | Triage

Analysis

max time kernel
28s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13/06/2023, 17:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

SyncData.exe
Size

117KB
MD5

1765e58ea435f52d2c1979b0c471a780
SHA1

9ce93c91fed2276495acf479be59e85200e9495b
SHA256

1a69fa239504e00c75f585740956581442c9bc32eb45ac65e0023aa872f387e3
SHA512

8049e3095b2a5154bfce2a26cc38229f2f378d64acd12e3085b5ce6e9180c193b0b579c9d0a96d0c19d5f9651196555bf702beabd8c1b30d629d9aa46e48d7e3
SSDEEP

1536:lD8MNPR2+MMyKEeLOfFVO/K6osHjjtf69eyVHmV1M3hsXuQ+MMnq:lQM9RbMMyKWso0S9TFsXuhMMq

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2028	2032	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2028	2032	SyncData.exe	28
PID 2032 wrote to memory of 2028	2032	SyncData.exe	28
PID 2032 wrote to memory of 2028	2032	SyncData.exe	28
PID 2032 wrote to memory of 2028	2032	SyncData.exe	28

C:\Users\Admin\AppData\Local\Temp\SyncData.exe
"C:\Users\Admin\AppData\Local\Temp\SyncData.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 552
  2⤵
  - Program crash
  PID:2028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2032-54-0x00000000012B0000-0x00000000012D2000-memory.dmp

Filesize
136KB

Download