75426e672b3356ed98af0b336345f4acd3f2ddf32c2997372f7cf318d7097eee | Triage

Analysis

max time kernel
122s
max time network
132s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 23:12

Sharing

Report Analysis Logs

General

Target

HackExternal.exe
Size

391KB
MD5

26910d2402b7c193f43f5070f4c5583d
SHA1

e8834552c969bff5172c9b134a113585026cc32a
SHA256

75426e672b3356ed98af0b336345f4acd3f2ddf32c2997372f7cf318d7097eee
SHA512

b6691ddd594de66723eb82ebc071de4609a146723ba6a8fb206e0b43a845ff20746b8461711f552708636f3fcdfc39a82b99f3cfef3b9da7e6830c3e55ac4646
SSDEEP

12288:/SZvrw6MnQYqA1Bsci8weHKbH2nb2LMDb:/S5w6MnGcBs2xKbH2nywD

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1280	HackExternal.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 2132	1280	HackExternal.exe	29
PID 1280 wrote to memory of 2132	1280	HackExternal.exe	29
PID 1280 wrote to memory of 2132	1280	HackExternal.exe	29
PID 1280 wrote to memory of 2648	1280	HackExternal.exe	30
PID 1280 wrote to memory of 2648	1280	HackExternal.exe	30
PID 1280 wrote to memory of 2648	1280	HackExternal.exe	30

C:\Users\Admin\AppData\Local\Temp\HackExternal.exe
"C:\Users\Admin\AppData\Local\Temp\HackExternal.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c kdmapper.exe driver.sys
  2⤵
  PID:2132
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1280 -s 320
  2⤵
  PID:2648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads