0737a1f9a3a049f4bda7694ab63b301cd53cd3967ce5a55d4094582e701c4390 | Triage

Analysis

max time kernel
141s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14-06-2023 13:55

Sharing

Report Analysis Logs

General

Target

BestFMS_13819.exe
Size

7.0MB
MD5

2e0df1f43ad97b03772587f803fe65cf
SHA1

b4ad453865f362cdff3833a1a188c2de4e3025d5
SHA256

0737a1f9a3a049f4bda7694ab63b301cd53cd3967ce5a55d4094582e701c4390
SHA512

448f5880fea7235a41e30dc4550ac9f4a40e3fa1926672c2cc047761d94277a9396eae6591484e73d6d49fb927754c76ecf1199cc2b8ee12a89dd2d7836e1057
SSDEEP

196608:B1BTxuBIkFvS47vNdFSD96NRZFuwPQ7hVi:DQIw37HsExFZI1Vi

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1980 2008 WerFault.exe BestFMS_13819.exe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

BestFMS_13819.exe

pid process

2008 BestFMS_13819.exe
2008 BestFMS_13819.exe
2008 BestFMS_13819.exe
2008 BestFMS_13819.exe
2008 BestFMS_13819.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

BestFMS_13819.exe

description	pid	process	target process
PID 2008 wrote to memory of 1980	2008	BestFMS_13819.exe	WerFault.exe
PID 2008 wrote to memory of 1980	2008	BestFMS_13819.exe	WerFault.exe
PID 2008 wrote to memory of 1980	2008	BestFMS_13819.exe	WerFault.exe
PID 2008 wrote to memory of 1980	2008	BestFMS_13819.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\BestFMS_13819.exe
"C:\Users\Admin\AppData\Local\Temp\BestFMS_13819.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 556
2⤵
- Program crash
PID:1980

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2008-54-0x0000000000400000-0x00000000029C7000-memory.dmp

Filesize
37.8MB

Download
memory/2008-55-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download