68097762e47e4ee48c7ab262abafc06a62dc303248d635f6b0bb46198ad0795b | Triage

Analysis

max time kernel
259s
max time network
316s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 13:44

Sharing

Report Analysis Logs

General

Target

CMipsPJ v3.002.exe
Size

7.7MB
MD5

361e92ba3ac8266a87ca272dc9f50b72
SHA1

d3ee38cffc4cf927cb886c05721e951b0060ac22
SHA256

68097762e47e4ee48c7ab262abafc06a62dc303248d635f6b0bb46198ad0795b
SHA512

4e4096a152ddc57204e5b48e3e9242d9f16ca91e9a8662daff776ff2e38af81311906c1448843c1a6f9f9821849153c1918d2fc162e509d819e23565cb58dfac
SSDEEP

196608:nQBaDVedbmWlSP5VwMDaYtuicJqqURBVlz:QBaDYkaMDaYtCax

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2372	2168	WerFault.exe	3

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2892	2168	CMipsPJ v3.002.exe	27
PID 2168 wrote to memory of 2892	2168	CMipsPJ v3.002.exe	27
PID 2168 wrote to memory of 2892	2168	CMipsPJ v3.002.exe	27
PID 2168 wrote to memory of 2892	2168	CMipsPJ v3.002.exe	27
PID 2168 wrote to memory of 2372	2168	CMipsPJ v3.002.exe	28
PID 2168 wrote to memory of 2372	2168	CMipsPJ v3.002.exe	28
PID 2168 wrote to memory of 2372	2168	CMipsPJ v3.002.exe	28
PID 2168 wrote to memory of 2372	2168	CMipsPJ v3.002.exe	28

C:\Users\Admin\AppData\Local\Temp\CMipsPJ v3.002.exe
"C:\Users\Admin\AppData\Local\Temp\CMipsPJ v3.002.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 544
  2⤵
  - Program crash
  PID:2372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2168-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2168-2-0x0000000000400000-0x0000000002A36000-memory.dmp

Filesize
38.2MB

Download
memory/2168-3-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2168-4-0x0000000000400000-0x0000000002A36000-memory.dmp

Filesize
38.2MB

Download