3455b844a3391bc5d5d24cdf303213e0f0163394b1b8cf14bdaf91e2b8776e38 | Triage

Analysis

max time kernel
142s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14-06-2023 20:00

Sharing

Report Analysis Logs

General

Target

BestFMS.exe
Size

7.2MB
MD5

f9b804b4f65fbbe93df4471618c3a5a5
SHA1

201de5705abde07272535e8274582e5d4ce22512
SHA256

3455b844a3391bc5d5d24cdf303213e0f0163394b1b8cf14bdaf91e2b8776e38
SHA512

7c153012c41da6b1bd969753e06125ec788bc75dfe8f7256eca2928a943c52ff139041e81a98c8e0c7ea572e7ce9b9a62aaa59aa6f0a334124c442d317bb9e57
SSDEEP

196608:9wi57Au2yMpolkfvBnvsAWA5jRDa+eEh4ZhtuNVqED:OM7cLnvVr7

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

860 928 WerFault.exe BestFMS.exe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

BestFMS.exe

pid process

928 BestFMS.exe
928 BestFMS.exe
928 BestFMS.exe
928 BestFMS.exe
928 BestFMS.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

BestFMS.exe

description	pid	process	target process
PID 928 wrote to memory of 860	928	BestFMS.exe	WerFault.exe
PID 928 wrote to memory of 860	928	BestFMS.exe	WerFault.exe
PID 928 wrote to memory of 860	928	BestFMS.exe	WerFault.exe
PID 928 wrote to memory of 860	928	BestFMS.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\BestFMS.exe
"C:\Users\Admin\AppData\Local\Temp\BestFMS.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 556
2⤵
- Program crash
PID:860

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/928-54-0x0000000000400000-0x0000000002BEB000-memory.dmp

Filesize
39.9MB

Download
memory/928-55-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download