8d4f62cde112ebad1da13a63c1620437e8dd5bfb07572f16a900a0ce0a0f40f3 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 16:19

Sharing

Report Analysis Logs

General

Target

Creal.exe
Size

14.3MB
MD5

334b8b048cbba70b243d7b2a722019e9
SHA1

e4f6057edaaa4531c9c69b92858ebdd6bd8e75f2
SHA256

8d4f62cde112ebad1da13a63c1620437e8dd5bfb07572f16a900a0ce0a0f40f3
SHA512

f889cdc91074c14b3dd924ba9acbd1764a4df073256ec999d3f6d8501f00f1808d15fe1452f88274a243f6213ae713e0b43185e95fcd04e460ed290b2cb35391
SSDEEP

393216:sX7QJidQuslSq99oWOv+9fgVByXmHE2w:sLQwdQuSDorvSYVBAGEX

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2728	Creal.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2728	3020	Creal.exe	20
PID 3020 wrote to memory of 2728	3020	Creal.exe	20
PID 3020 wrote to memory of 2728	3020	Creal.exe	20

C:\Users\Admin\AppData\Local\Temp\Creal.exe
"C:\Users\Admin\AppData\Local\Temp\Creal.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Users\Admin\AppData\Local\Temp\Creal.exe
  "C:\Users\Admin\AppData\Local\Temp\Creal.exe"
  2⤵
  - Loads dropped DLL
  PID:2728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads