e1c7d09afcada193579ac21b5e3c3ab9eb710576ebc835358add821ddde3a139 | Triage

Analysis

max time kernel
28s
max time network
32s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
04-07-2023 04:55

Sharing

Report Analysis Logs

General

Target

TheTacoVerseTales.exe
Size

104KB
MD5

85edd39151d85c0c2a0c5f640ff2f44e
SHA1

0a899342f0adca93d82a09c10c0b634db3492781
SHA256

e1c7d09afcada193579ac21b5e3c3ab9eb710576ebc835358add821ddde3a139
SHA512

46c5c4d131de248b7334280e9d0adf5b3659f6eea2e23a33eab94a0253f7d1c567cbaf3a480d8027dd601888a9e62a17bad3c0a9132f2211ed1686ea4f26b76c
SSDEEP

3072:NL3Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:ZQ+IFCumUGekHRvEuO3go9kfnQ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2292	2300	WerFault.exe	28

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2292	2300	TheTacoVerseTales.exe	29
PID 2300 wrote to memory of 2292	2300	TheTacoVerseTales.exe	29
PID 2300 wrote to memory of 2292	2300	TheTacoVerseTales.exe	29

C:\Users\Admin\AppData\Local\Temp\TheTacoVerseTales.exe
"C:\Users\Admin\AppData\Local\Temp\TheTacoVerseTales.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2300 -s 56
  2⤵
  - Program crash
  PID:2292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2300-54-0x0000000140000000-0x0000000140021000-memory.dmp

Filesize
132KB

Download