e3026e2bd11e4d1f35c49a32bdc24d1b29dd62394d68c51361f590ff7886e091 | Triage

Analysis

max time kernel
120s
max time network
182s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
03/10/2023, 16:50

Sharing

Report Analysis Logs

General

Target

Tools/MouseInc/MouseInc.exe
Size

1.2MB
MD5

f91badf0ffd4c981ecc18bfd27ba3c61
SHA1

277b37889536d71c69eb01eabb0612ae3f998bbf
SHA256

2007971f7c44dbeaa0c6d2f06933a1f0b8f0e228a67257149658f40e2b8b6ea8
SHA512

e5c4003a8cbd68297d539da6377e00203bc115bef6c8f257e92befc5983905fff7b89c0f60f975543ae89a120d525f3c30cbe8a5c432fb70e9ca9c5d23995d0c
SSDEEP

24576:SACAM65EglFPp4hNqSB4YbH1Sn3nx/ny9:SACAM6igrLs4Egn3xvk

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2516	2428	WerFault.exe	26

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2428	MouseInc.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2428	MouseInc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2428	MouseInc.exe
2428	MouseInc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2516	2428	MouseInc.exe	30
PID 2428 wrote to memory of 2516	2428	MouseInc.exe	30
PID 2428 wrote to memory of 2516	2428	MouseInc.exe	30
PID 2428 wrote to memory of 2516	2428	MouseInc.exe	30

C:\Users\Admin\AppData\Local\Temp\Tools\MouseInc\MouseInc.exe
"C:\Users\Admin\AppData\Local\Temp\Tools\MouseInc\MouseInc.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 1376
  2⤵
  - Program crash
  PID:2516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2428-0-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2428-3-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download