93418ec61e1f96a46e9f64b3858e3c8dd4f0530083d6eace8d691ef319d4535f | Triage

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
31/10/2023, 19:28

Sharing

Report Analysis Logs

General

Target

Fluster.Installer.exe
Size

20KB
MD5

efa51e048948bf4d35a671d5e70d966d
SHA1

a34040e4f8600b2bf5da78c352827fa884ac4a66
SHA256

93418ec61e1f96a46e9f64b3858e3c8dd4f0530083d6eace8d691ef319d4535f
SHA512

1b3536ca4df42ef23e04276db52f0e46e68b189c45ac9b5e00fb16996e3a720eb0d4ebd93b8a434c518c8189c93fe47f263b914d4021c5893f0361e2afa18d9d
SSDEEP

384:vp01C2uxtRmV6d1Fd7irBYYgeaaQMgR7U3m8J:RfRs61F4uY3aaQMgR7U3m8J

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 2608	2760	Fluster.Installer.exe	29
PID 2760 wrote to memory of 2608	2760	Fluster.Installer.exe	29
PID 2760 wrote to memory of 2608	2760	Fluster.Installer.exe	29

C:\Users\Admin\AppData\Local\Temp\Fluster.Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Fluster.Installer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:2608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads