7afd7aa833f08a6979f4871225bd17cc9a2a27f48cb2904707bd959a2258660a | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 07:05

Sharing

Report Analysis Logs

General

Target

connection blocker.exe
Size

3.3MB
MD5

7bccb8c82cb4e5a9fa8abb9d01147c84
SHA1

15ec48c1f7f1073cb0e39ba9e64ac7e18416f25c
SHA256

4d1ef869c4bddeccc318939ea2651ce5a3fc2e369ba44a2e24cb9b102ef2be19
SHA512

0def83faec17bcd7197aacfe8f7bdaabbfcbdff8be81da74b28b2163026326a33e47dbd72d7d036658fb64a54b4f50ee5e93893bc7740e93206cf7105f0fd7e4
SSDEEP

49152:Kc+EsyI9HTm5uNIQoF0EWe2LF8P5T708bYOGg:Kcx8x00EWe2J8P5TI8bYvg

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2108	2268	connection blocker.exe	29
PID 2268 wrote to memory of 2108	2268	connection blocker.exe	29
PID 2268 wrote to memory of 2108	2268	connection blocker.exe	29

C:\Users\Admin\AppData\Local\Temp\connection blocker.exe
"C:\Users\Admin\AppData\Local\Temp\connection blocker.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2268 -s 108
  2⤵
  PID:2108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2268-0-0x0000000000660000-0x00000000008B8000-memory.dmp

Filesize
2.3MB

Download