f81565af7104b058df585fd627ac4c61a86e947632d04838a533b0e00907902b | Triage

Resubmissions

08-07-2023 17:02

230708-vkemzafh27 8

08-07-2023 16:53

230708-vd57cagg21 8

Analysis

max time kernel
27s
max time network
32s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
08-07-2023 16:53

Sharing

Report Analysis Logs

General

Target

Latex-Split-Table-Column.exe
Size

300.4MB
MD5

eff4dee32ca0f188b0f6ebe24799a489
SHA1

d3980fba6bf04a63567954fa7ce8b645fc20367c
SHA256

278ec8f7a0cd969ebb84e72f60f19bb6f6fd6f7268ebe68245c46e6de2a43cf1
SHA512

d6665b744541124d5172348a3b035f14e06594a6a5e0655e69053189a9e5f801774d8580ca06dbf322e1ab698c77f94fa94fa4b4ee150f80981bbac429bf9650
SSDEEP

49152:2OM9NlsVy2qjNdgk84444444444444444444444444444444444444444444444S:2f

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2368	2320	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2368	2320	Latex-Split-Table-Column.exe	28
PID 2320 wrote to memory of 2368	2320	Latex-Split-Table-Column.exe	28
PID 2320 wrote to memory of 2368	2320	Latex-Split-Table-Column.exe	28

C:\Users\Admin\AppData\Local\Temp\Latex-Split-Table-Column.exe
"C:\Users\Admin\AppData\Local\Temp\Latex-Split-Table-Column.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2320 -s 532
  2⤵
  - Program crash
  PID:2368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2320-54-0x0000000000950000-0x0000000001950000-memory.dmp

Filesize
16.0MB

Download