e113bd8212066ab58ae9b21c0542b31f54e77019f229803ad6068fbbf32f18d8 | Triage

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13-06-2023 19:24

Sharing

Report Analysis Logs

General

Target

B2C.YS_E5.exe
Size

60KB
MD5

a7271778b357cd27f803499be1488042
SHA1

b5d2e4e1f497eb501402e17526886608189fae8f
SHA256

e113bd8212066ab58ae9b21c0542b31f54e77019f229803ad6068fbbf32f18d8
SHA512

dd7a7292adc69aa2a4ddb6eea796d69bc54eefcf8225149e8d3bcf0fb9d07cb9f5a191b8f9f0fb36e9eead4f689bd92b14f1e9dde923d9120831ed7fd0916489
SSDEEP

768:cEQghiVk/0/KNsZCMSH7ko4ciGEDs66lWjJP30RfW4Zrg1/r:MTVGzsZfSHV4cuDs6T90RWQ8R

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
268	1240	WerFault.exe	26

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 268	1240	B2C.YS_E5.exe	27
PID 1240 wrote to memory of 268	1240	B2C.YS_E5.exe	27
PID 1240 wrote to memory of 268	1240	B2C.YS_E5.exe	27

C:\Users\Admin\AppData\Local\Temp\B2C.YS_E5.exe
"C:\Users\Admin\AppData\Local\Temp\B2C.YS_E5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1240 -s 536
  2⤵
  - Program crash
  PID:268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1240-54-0x0000000000E40000-0x0000000000E54000-memory.dmp

Filesize
80KB

Download