e345f0b208f01df573c2ac4ba795dbfd5c4433a54735ad7e96a71d07d4530346 | Triage

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
17/11/2023, 18:56

Sharing

Report Analysis Logs

General

Target

ExitLag.exe
Size

45KB
MD5

9ddf010f697ebad05215e628b1e943ae
SHA1

93c85d27d08231ebd894db459cd3c1f68a12f22a
SHA256

e345f0b208f01df573c2ac4ba795dbfd5c4433a54735ad7e96a71d07d4530346
SHA512

b0dba18feac7f90f790077a109264a863e5da6de480cc21ec807f046260b3a687720f2189dba3162e9bdea401cb9df16676ca16c530afbc694e1249c56548477
SSDEEP

768:kzjPS4HsQPF+iJwfKhed0rt5guF3qazxq3qazxB3qazxF3qazx9:Ejq4MQPg9dkUuNqaz0qaz7qazzqazv

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1860	3012	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 1860	3012	ExitLag.exe	28
PID 3012 wrote to memory of 1860	3012	ExitLag.exe	28
PID 3012 wrote to memory of 1860	3012	ExitLag.exe	28
PID 3012 wrote to memory of 1860	3012	ExitLag.exe	28

C:\Users\Admin\AppData\Local\Temp\ExitLag.exe
"C:\Users\Admin\AppData\Local\Temp\ExitLag.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 632
  2⤵
  - Program crash
  PID:1860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3012-0-0x0000000000100000-0x0000000000112000-memory.dmp

Filesize
72KB

Download
memory/3012-1-0x0000000074EA0000-0x000000007558E000-memory.dmp

Filesize
6.9MB

Download
memory/3012-2-0x0000000004930000-0x0000000004970000-memory.dmp

Filesize
256KB

Download
memory/3012-3-0x0000000074EA0000-0x000000007558E000-memory.dmp

Filesize
6.9MB

Download