d88f6a30e5efce4e781d6530f4949cf4a5f42cb423a5ba7e0e6761679192818b | Triage

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 13:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bypass-clm.exe
Size

9KB
MD5

a39ebcfe3d666f37a62766f3f937e861
SHA1

ae0d20ab0bbcf2b4b835042c8d8b9477f8e385a9
SHA256

d88f6a30e5efce4e781d6530f4949cf4a5f42cb423a5ba7e0e6761679192818b
SHA512

389159087e371e594bf3916edcdd9b8547372083a54a5bc2c61ebd9c1eea50de9d9e0bd97c0dd8157da11014efff9e589640cf03a695acca68f65d99f604ff31
SSDEEP

192:FtnINSC+wYK+D0py1LpQY+JcDUr1bpHu3XaqjS0Xu9t:LnpTwYK+8yJpQY+JcDG/kqMS0+9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2136	2308	bypass-clm.exe	31
PID 2308 wrote to memory of 2136	2308	bypass-clm.exe	31
PID 2308 wrote to memory of 2136	2308	bypass-clm.exe	31

C:\Users\Admin\AppData\Local\Temp\bypass-clm.exe
"C:\Users\Admin\AppData\Local\Temp\bypass-clm.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2308 -s 536
  2⤵
  PID:2136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2308-0-0x000007FEF5670000-0x000007FEF605C000-memory.dmp

Filesize
9.9MB

Download
memory/2308-1-0x000000013F730000-0x000000013F736000-memory.dmp

Filesize
24KB

Download
memory/2308-2-0x000007FEF5670000-0x000007FEF605C000-memory.dmp

Filesize
9.9MB

Download