Analysis

  • max time kernel
    131s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    12/10/2023, 12:34

General

  • Target

    Gtzzucrmbyfogz.exe

  • Size

    1.6MB

  • MD5

    41fca559302236c81ecf62501d240a0c

  • SHA1

    ea35fb19bb74e639c66f235b7b3b5b06fab3eb65

  • SHA256

    a98c998bfd92e84cee4401dd2ca4f4a088043e33cc414ffb8d26f4af871e50bd

  • SHA512

    c29fb389c5903c8e3b9fde81344f15356f1c54dc4a1da5d35fb4228106833eea4bf054202a2b23514363009e674fa2621ff73726a1af46f559d16db5b6faf2bd

  • SSDEEP

    24576:XkBHomD+FDtdfE222kxVoy+OQp6DjasufyJIZlnLxGgVzwmDi1ETNay76nBWWnme:XjFDnE22efn513VzrunNxNeE

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Gtzzucrmbyfogz.exe
    "C:\Users\Admin\AppData\Local\Temp\Gtzzucrmbyfogz.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2372
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 712
      2⤵
      • Program crash
      PID:2468

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\CabC322.tmp

          Filesize

          61KB

          MD5

          f3441b8572aae8801c04f3060b550443

          SHA1

          4ef0a35436125d6821831ef36c28ffaf196cda15

          SHA256

          6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

          SHA512

          5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

        • C:\Users\Admin\AppData\Local\Temp\TarC3A2.tmp

          Filesize

          163KB

          MD5

          9441737383d21192400eca82fda910ec

          SHA1

          725e0d606a4fc9ba44aa8ffde65bed15e65367e4

          SHA256

          bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

          SHA512

          7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

        • memory/2372-0-0x00000000001B0000-0x00000000001B1000-memory.dmp

          Filesize

          4KB

        • memory/2372-4-0x0000000000400000-0x00000000005AC000-memory.dmp

          Filesize

          1.7MB