Analysis

  • max time kernel
    41s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    02/11/2023, 19:46

General

  • Target

    554489fe5d2e1e0ea325d54a6e5ed1042b178b601217b584535aa5b30e474875.exe

  • Size

    375KB

  • MD5

    fd36e16bd6a199b8289a7bdfd45de021

  • SHA1

    02a6ededf69d3d4dcce52b4c1261c2a9b15cba3c

  • SHA256

    554489fe5d2e1e0ea325d54a6e5ed1042b178b601217b584535aa5b30e474875

  • SHA512

    c2d4768de725b098dd78443de6c8f350bf366fc1c8813bce6cebf8773cd54cd470680a7b8c3399735f2ec52a71b5ab97da9e5253298ec428f07e7d6effffdc16

  • SSDEEP

    6144:qaq8vzvMEQ2MQEObF6CX6pQFeE6dtRtWvOMo9g4lSpzceUD4bVZ3PSNb2b0jexOO:qaqmzvMEQ2MQEObF6CX6pQFeE6dv2AIH

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\554489fe5d2e1e0ea325d54a6e5ed1042b178b601217b584535aa5b30e474875.exe
    "C:\Users\Admin\AppData\Local\Temp\554489fe5d2e1e0ea325d54a6e5ed1042b178b601217b584535aa5b30e474875.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1744
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 572
      2⤵
      • Program crash
      PID:2092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1744-0-0x0000000000E90000-0x0000000000EF4000-memory.dmp

    Filesize

    400KB

  • memory/1744-1-0x0000000074630000-0x0000000074D1E000-memory.dmp

    Filesize

    6.9MB

  • memory/1744-2-0x0000000074630000-0x0000000074D1E000-memory.dmp

    Filesize

    6.9MB