dfb6b348589efb406083311e23cb844bc446a85c01e9b9d32513637bddd94c44 | Triage

Analysis

max time kernel
25s
max time network
29s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14/06/2023, 08:52

Sharing

Report Analysis Logs

General

Target

JSYZJ.exe
Size

724KB
MD5

3168ffd68bf181acb4d4b301cb842f3d
SHA1

2f5d790f66d37b4387d10f4cf8a92a788be738dc
SHA256

dfb6b348589efb406083311e23cb844bc446a85c01e9b9d32513637bddd94c44
SHA512

6206ae423b46e5b7fdcf7ca3673a4ecc720f0e807f804f03eaeac932e9dc47b96953d82f26bbbfebde8525c906e6c96b437ba351c4a38d562fc4e7473721f24b
SSDEEP

12288:X9DXaw/wGlcLyXQmJnzHRsbuNooJldpc5gmt/aqqqq9esHjdETNEbAi+akFgtme:Hpzmxaqqqq9HWli+aie

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2040	912	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 2040	912	JSYZJ.exe	27
PID 912 wrote to memory of 2040	912	JSYZJ.exe	27
PID 912 wrote to memory of 2040	912	JSYZJ.exe	27
PID 912 wrote to memory of 2040	912	JSYZJ.exe	27

C:\Users\Admin\AppData\Local\Temp\JSYZJ.exe
"C:\Users\Admin\AppData\Local\Temp\JSYZJ.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 912 -s 552
  2⤵
  - Program crash
  PID:2040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/912-54-0x0000000001240000-0x00000000012FA000-memory.dmp

Filesize
744KB

Download