3a920173df201e7f1b16989f5fc7bcabd6d2d8d63693289056dfaef1e272a8e8 | Triage

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
30/10/2023, 11:42

Sharing

Report Analysis Logs

General

Target

seba.exe
Size

25KB
MD5

cc3a38208b901fcf496c9bab3a27583c
SHA1

3b664877a2aa40e52216339cb0a15996843cfd0d
SHA256

3a920173df201e7f1b16989f5fc7bcabd6d2d8d63693289056dfaef1e272a8e8
SHA512

f0afb90ad7f6b27c87de7422a80e7f184d09b7da825547705f9f0bad1219ae2e8801d9c2acd7917b1d10a5addb7f7a4b0c5756a7fd2b4b58c1a8832142f76b75
SSDEEP

768:oEHP8sBn3HQVOaqM41v1HbVlngm3HrdG:oEHP8syITTTnX3E

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 3044	2972	seba.exe	29
PID 2972 wrote to memory of 3044	2972	seba.exe	29
PID 2972 wrote to memory of 3044	2972	seba.exe	29

C:\Users\Admin\AppData\Local\Temp\seba.exe
"C:\Users\Admin\AppData\Local\Temp\seba.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2972 -s 540
  2⤵
  PID:3044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2972-0-0x0000000000DA0000-0x0000000000DAC000-memory.dmp

Filesize
48KB

Download
memory/2972-1-0x000007FEF5B60000-0x000007FEF654C000-memory.dmp

Filesize
9.9MB

Download
memory/2972-2-0x000007FEF5B60000-0x000007FEF654C000-memory.dmp

Filesize
9.9MB

Download