0e24b8e9026309ce107cc22c3e37d189b3491a500c0282e029da324733772051 | Triage

Analysis

max time kernel
146s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06-01-2024 08:24

Sharing

Report Analysis Logs

General

Target

Update.exe
Size

378KB
MD5

07e615b0caf3fe0f1b490d3fbb9a6a43
SHA1

67adcdc5073df688cc16747510e0a0806ef82f56
SHA256

aa855f9e109087f43877ab2245a71142b467dda764094d283e02eeb49e36fdd3
SHA512

a64fc4bf98f6716f3ea33783517ebd14e41622e2641cdc01221fee041f9512a076413fdccfd661bdb4f71bc5db10655a068c9a0d06f90935bedb918aa15af64e
SSDEEP

6144:pH1JZRILgM2u+nmzK6QgSuHL5vj6pNmRF8VrN+cCsNOJoJePU5WaANs:lIEGpzK6FSkFvBRSVkcCsNOeJePUAays

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2948	2444	WerFault.exe	4

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2948	2444	Update.exe	25
PID 2444 wrote to memory of 2948	2444	Update.exe	25
PID 2444 wrote to memory of 2948	2444	Update.exe	25
PID 2444 wrote to memory of 2948	2444	Update.exe	25

C:\Users\Admin\AppData\Local\Temp\Update.exe
"C:\Users\Admin\AppData\Local\Temp\Update.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 124
  2⤵
  - Program crash
  PID:2948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2444-0-0x0000000000DF0000-0x0000000000E95000-memory.dmp

Filesize
660KB

Download
memory/2444-1-0x0000000000DF0000-0x0000000000E95000-memory.dmp

Filesize
660KB

Download