8b822f9039be4e971694d16db86afd0d3d863a945b093e7ae00c56cfd8b3481a | Triage

Analysis

max time kernel
27s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13/06/2023, 19:27

Sharing

Report Analysis Logs

General

Target

HOPES.POS_QCT.exe
Size

397KB
MD5

6a925d4bb31557c97de8fd793ece9730
SHA1

3235701ce22a3c6dabda65aab1442b8adb49a249
SHA256

8b822f9039be4e971694d16db86afd0d3d863a945b093e7ae00c56cfd8b3481a
SHA512

47e9b38a054906a254602cf2d890f9bc88b313f5e447cdae7633e175b9928d13c9b58ec51e01d5c2c320f3a6c9b9f0e671d97a124729bd6f2f3ac72a5643e448
SSDEEP

12288:Ama9OjB9HLAPz/drby0Jpod2HC7iKL5dS3BKm8X5L:AmauXEPzV7oEtKL5030

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1904	704	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 704 wrote to memory of 1904	704	HOPES.POS_QCT.exe	27
PID 704 wrote to memory of 1904	704	HOPES.POS_QCT.exe	27
PID 704 wrote to memory of 1904	704	HOPES.POS_QCT.exe	27
PID 704 wrote to memory of 1904	704	HOPES.POS_QCT.exe	27

C:\Users\Admin\AppData\Local\Temp\HOPES.POS_QCT.exe
"C:\Users\Admin\AppData\Local\Temp\HOPES.POS_QCT.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 704 -s 556
  2⤵
  - Program crash
  PID:1904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/704-54-0x0000000000F10000-0x0000000000F7A000-memory.dmp

Filesize
424KB

Download