Resubmissions

02/12/2024, 10:27

241202-mg4hxswqbl 10

02/12/2024, 10:25

241202-mgevka1jfx 10

02/12/2024, 10:24

241202-mfqkns1jdy 10

23/06/2023, 02:54

230623-dd7xhabd82 3

Analysis

  • max time kernel
    291s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20230621-en
  • resource tags

    arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
  • submitted
    23/06/2023, 02:54

General

  • Target

    bad_rhy_mayb.exe

  • Size

    1.2MB

  • MD5

    59a9ca795b59161f767b94fc2dece71a

  • SHA1

    b07f6a5f61834a57304ad4d885bd37d8e1badba8

  • SHA256

    250e81eeb4df4649ccb13e271ae3f80d44995b2f8ffca7a2c5e1c738546c2ab1

  • SHA512

    ec59175002bd9c11c62e83aef2d1b99f883a0f71a151bee5ab1107d3f795b3e5cdd78f13348fd64eed563f6a5df5a0fef3977a8841f4ea4712ff1c2f7e18c222

  • SSDEEP

    24576:ztP7hdO1s6Skscec1SgnyN9HPFCCNhQI6GOfaFVIVrYwcMavbiZn3m75/J2:BLO1qkscec0gnyN9HPFCCNSI6GOfaFVc

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bad_rhy_mayb.exe
    "C:\Users\Admin\AppData\Local\Temp\bad_rhy_mayb.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1316
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1316 -s 72
      2⤵
      • Program crash
      PID:852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1316-54-0x0000000000400000-0x0000000000523000-memory.dmp

    Filesize

    1.1MB