847a73bf670867d2994ec27b1fd9710af3e5017da6d510b09b6fe4dae8605df7 | Triage

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14/06/2023, 20:08

Sharing

Report Analysis Logs

General

Target

LSTest.exe
Size

118KB
MD5

092c91e0d793f8d9d93074ae93313c43
SHA1

808d373ec75c9ba6f5ec45b287e1007e4f31c976
SHA256

847a73bf670867d2994ec27b1fd9710af3e5017da6d510b09b6fe4dae8605df7
SHA512

169e77e881a514b1e3ee6ad5b3be60be9945677f79f8969611c6108d0890ecaf33723593210da54019564a9f0bbcb82e1a2dbe3b0fb7a7f1caabddf17ae12810
SSDEEP

3072:XR4aIzZ2AZQhDP3Aj5203hnegB25XsPtSMOX5DLZDTQvj/RDpKk6:XL6awnhkclSXX5PxQrvK

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1296	1204	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1296	1204	LSTest.exe	28
PID 1204 wrote to memory of 1296	1204	LSTest.exe	28
PID 1204 wrote to memory of 1296	1204	LSTest.exe	28
PID 1204 wrote to memory of 1296	1204	LSTest.exe	28

C:\Users\Admin\AppData\Local\Temp\LSTest.exe
"C:\Users\Admin\AppData\Local\Temp\LSTest.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 548
  2⤵
  - Program crash
  PID:1296

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1204-54-0x0000000001020000-0x0000000001044000-memory.dmp

Filesize
144KB

Download