03ab73a4eef111fdcad67002e344056618f4c09c38825de7a21f3716139018c9 | Triage

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
05-07-2023 15:11

Sharing

Report Analysis Logs

General

Target

SkyClient.exe
Size

78KB
MD5

1aa411bc1aad934800d4ccaa589aa548
SHA1

bf7d2e00424f70eb0c638973d80098d002a715c2
SHA256

03ab73a4eef111fdcad67002e344056618f4c09c38825de7a21f3716139018c9
SHA512

1352fefc34eac07058a39cb90eebefccdb2c777299a68ffe242a0689a6ed443ff14a36ace7164d70eb94c13566aca8c8f4aea7d203b40075498121a70c0f015d
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+BPIC:5Zv5PDwbjNrmAE+RIC

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2316	3060	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 2316	3060	SkyClient.exe	28
PID 3060 wrote to memory of 2316	3060	SkyClient.exe	28
PID 3060 wrote to memory of 2316	3060	SkyClient.exe	28

C:\Users\Admin\AppData\Local\Temp\SkyClient.exe
"C:\Users\Admin\AppData\Local\Temp\SkyClient.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3060 -s 600
  2⤵
  - Program crash
  PID:2316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3060-54-0x000000013F860000-0x000000013F878000-memory.dmp

Filesize
96KB

Download
memory/3060-55-0x0000000000540000-0x00000000005C0000-memory.dmp

Filesize
512KB

Download
memory/3060-56-0x0000000000540000-0x00000000005C0000-memory.dmp

Filesize
512KB

Download