73dae925d7b1e85ea510421587f7c351ba2cb184dd3009edfd82d75ea18a3aa1 | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13/10/2023, 12:48

Sharing

Report Analysis Logs

General

Target

PO17.exe
Size

564KB
MD5

985f40672b9d8dabfa5c92d1798d88f9
SHA1

b1c0fc03a274f683779f863138546aa625af632a
SHA256

73dae925d7b1e85ea510421587f7c351ba2cb184dd3009edfd82d75ea18a3aa1
SHA512

371917323930466daf2df7498ad0036c97adecbf862924d0af87e380da11a7e915b985db25d78552760ae3fefcfebd74a919ef9c31944ac74a8d2998940a48d8
SSDEEP

12288:P2suo0ml+G/HVM3WlmbP9GkRSRIUPIQjxkD6gAoT9XYVgwv4:10ml+GdM3WlwFGcAIQN

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2240	2336	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2240	2336	PO17.exe	28
PID 2336 wrote to memory of 2240	2336	PO17.exe	28
PID 2336 wrote to memory of 2240	2336	PO17.exe	28
PID 2336 wrote to memory of 2240	2336	PO17.exe	28

C:\Users\Admin\AppData\Local\Temp\PO17.exe
"C:\Users\Admin\AppData\Local\Temp\PO17.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 572
  2⤵
  - Program crash
  PID:2240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2336-0-0x0000000001230000-0x00000000012C2000-memory.dmp

Filesize
584KB

Download
memory/2336-1-0x0000000073F20000-0x000000007460E000-memory.dmp

Filesize
6.9MB

Download
memory/2336-2-0x0000000073F20000-0x000000007460E000-memory.dmp

Filesize
6.9MB

Download