4149941526aae506904d304a14679dbaac612bff7997c28b0ae6de4c92099806 | Triage

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13-06-2023 19:24

Sharing

Report Analysis Logs

General

Target

DRP7.NET_ETP.exe
Size

211KB
MD5

1c397d4928df8b5e5f9111615f9f11f7
SHA1

3d34b4645f54b31ff564efb7b4c939b5be20a456
SHA256

4149941526aae506904d304a14679dbaac612bff7997c28b0ae6de4c92099806
SHA512

99b1b11dcdbfce98a626e6990b082162569494d8c660edab1bc30d990db276e4720544cc7e229e993cff3c8a02ccddf6bfe38c20fca766fbf3eba2a628351447
SSDEEP

6144:kY0EZ1rN1nEwO01enKsjARgMPxRVVnahxRMG:q01Z6wOFnKs5q

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1316	1732	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1316	1732	DRP7.NET_ETP.exe	28
PID 1732 wrote to memory of 1316	1732	DRP7.NET_ETP.exe	28
PID 1732 wrote to memory of 1316	1732	DRP7.NET_ETP.exe	28

C:\Users\Admin\AppData\Local\Temp\DRP7.NET_ETP.exe
"C:\Users\Admin\AppData\Local\Temp\DRP7.NET_ETP.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1732 -s 536
  2⤵
  - Program crash
  PID:1316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1732-54-0x0000000001380000-0x00000000013BA000-memory.dmp

Filesize
232KB

Download