fe11e9a33d38be450c6e95a499233defd67de8e47d17276316697bde27e6bfcf | Triage

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
13-11-2023 05:04

Sharing

Report Analysis Logs

General

Target

HS_ZHY.exe
Size

12.6MB
MD5

2b4e00f7fb80e9e56ded649cfc61ab55
SHA1

ed513ba445807335eb730fbe724cd38062540803
SHA256

cc1b10edd9b101cae0bc9788aaf185d890b0a3c0f2113d7bf739bc456c12eeeb
SHA512

9e9551478491fbdf13556cc426910ef52f8575d8243f940f3eb34684d00ae9a765dbf8854edaf718ac5719d378a3014ade9106d743360906fc51cec1206269e9
SSDEEP

196608:VUBVvcLcLcLcbcXE/JgfmA/STG5555LsjwfP:VUBFcLcLcLcbc4gfkTG5555LsEf

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2908 2988 WerFault.exe HS_ZHY.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

HS_ZHY.exe

description	pid	process	target process
PID 2988 wrote to memory of 2908	2988	HS_ZHY.exe	WerFault.exe
PID 2988 wrote to memory of 2908	2988	HS_ZHY.exe	WerFault.exe
PID 2988 wrote to memory of 2908	2988	HS_ZHY.exe	WerFault.exe
PID 2988 wrote to memory of 2908	2988	HS_ZHY.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\HS_ZHY.exe
"C:\Users\Admin\AppData\Local\Temp\HS_ZHY.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 552
2⤵
- Program crash
PID:2908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2988-0-0x00000000749C0000-0x00000000750AE000-memory.dmp

Filesize
6.9MB

Download
memory/2988-1-0x0000000000C10000-0x00000000018B6000-memory.dmp

Filesize
12.6MB

Download
memory/2988-2-0x00000000749C0000-0x00000000750AE000-memory.dmp

Filesize
6.9MB

Download