4b60828eefb73712547f14313208a090791b0abdb3e60ab0dfa1b3eb0ba84290 | Triage

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/01/2024, 06:48

Sharing

Report Analysis Logs

General

Target

66f6a88a495ce603d3d36d6c618c38dd.exe
Size

416KB
MD5

66f6a88a495ce603d3d36d6c618c38dd
SHA1

0ba4d5d10b3317d84ba12abc98b6bb6ba41893d4
SHA256

4b60828eefb73712547f14313208a090791b0abdb3e60ab0dfa1b3eb0ba84290
SHA512

356ece858c98d75c8da5923e491324825d477d6b1678fe08fc58e71f831c7025090e94044a7216c557a7ffda62f5d02311731b2029cdf7d8bafd45bc4585b714
SSDEEP

12288:8cDZ+RN8T2v2sXdpRN8T2v2sXd41MD+b:8XnOsXdhnOsXd6u+b

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 2188	828	66f6a88a495ce603d3d36d6c618c38dd.exe	28
PID 828 wrote to memory of 2188	828	66f6a88a495ce603d3d36d6c618c38dd.exe	28
PID 828 wrote to memory of 2188	828	66f6a88a495ce603d3d36d6c618c38dd.exe	28

C:\Users\Admin\AppData\Local\Temp\66f6a88a495ce603d3d36d6c618c38dd.exe
"C:\Users\Admin\AppData\Local\Temp\66f6a88a495ce603d3d36d6c618c38dd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 828 -s 148
  2⤵
  PID:2188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/828-0-0x0000000100000000-0x000000010006D000-memory.dmp

Filesize
436KB

Download
memory/828-1-0x0000000100000000-0x000000010006D000-memory.dmp

Filesize
436KB

Download