85f900d9f5f642bdca62f9ca75591131da27ec8fabf344e54bd696c78eab0b02 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 04:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0e5590984bf0a7bfc93f0b2c588de44a.exe
Size

233KB
MD5

0e5590984bf0a7bfc93f0b2c588de44a
SHA1

b15ad338008dbfbf1446f4820eb979a6d76548a1
SHA256

85f900d9f5f642bdca62f9ca75591131da27ec8fabf344e54bd696c78eab0b02
SHA512

83103ae6e4cedf4dd48328b9017679b45161a0af9530df61c4d3c8fc7a3d3b249176491d8f3dbe09907fe4fa14118374b857c25779d37a8bd96434023213c02a
SSDEEP

3072:tf01isbaBtXg0As83+lpCIJT0fsUpzcggZmuhJNq:m1hbmGEZmmT

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 3044	3024	0e5590984bf0a7bfc93f0b2c588de44a.exe	28
PID 3024 wrote to memory of 3044	3024	0e5590984bf0a7bfc93f0b2c588de44a.exe	28
PID 3024 wrote to memory of 3044	3024	0e5590984bf0a7bfc93f0b2c588de44a.exe	28

C:\Users\Admin\AppData\Local\Temp\0e5590984bf0a7bfc93f0b2c588de44a.exe
"C:\Users\Admin\AppData\Local\Temp\0e5590984bf0a7bfc93f0b2c588de44a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3024 -s 528
  2⤵
  PID:3044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3024-0-0x0000000000220000-0x0000000000260000-memory.dmp

Filesize
256KB

Download
memory/3024-1-0x000007FEF5780000-0x000007FEF616C000-memory.dmp

Filesize
9.9MB

Download
memory/3024-2-0x000007FEF5780000-0x000007FEF616C000-memory.dmp

Filesize
9.9MB

Download