Analysis

  • max time kernel
    118s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    15/11/2023, 10:45

General

  • Target

    resources.exe

  • Size

    65KB

  • MD5

    693a87312aa1f6a31906187bda5293df

  • SHA1

    aaf236f3c5e791bd4f98d2c12758ff251c3b8474

  • SHA256

    f33cdca93db97c4b84af9f01216f3b7bcb3cf1865df84cb3b64fbbeed7057a2a

  • SHA512

    1c6e618ddb11d438286a032e6acd79fcb5fd89efa4fd2f3b1b4ae91785ac4a7ef8b894b910cd8394225118974e7a19aeb337313273cda2d2b0d9923cb3a212e2

  • SSDEEP

    1536:dfHn5T82s45tlDqwIdvKKBLutvfFoV/XUuL:dfH5TZsYnjIdbCNNoV/Xt

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\resources.exe
    "C:\Users\Admin\AppData\Local\Temp\resources.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2124
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 820
      2⤵
      • Program crash
      PID:2920

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2124-0-0x0000000000880000-0x0000000000896000-memory.dmp

          Filesize

          88KB

        • memory/2124-1-0x0000000074530000-0x0000000074C1E000-memory.dmp

          Filesize

          6.9MB

        • memory/2124-3-0x0000000074530000-0x0000000074C1E000-memory.dmp

          Filesize

          6.9MB