244f5391b6f3ffc701ba75766023421bcd8b0cb1046611993285b6545a099e93 | Triage

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/01/2024, 23:57

Sharing

Report Analysis Logs

General

Target

Bright_Past.exe
Size

105KB
MD5

3b15530ecdf5c5013a8d7109dbf6a7b1
SHA1

d6f5b60b9caca68f3dd9f3508114537bab293a52
SHA256

244f5391b6f3ffc701ba75766023421bcd8b0cb1046611993285b6545a099e93
SHA512

356ef0ec9a89ee71fe2acd7c2cf82ca3a8666f7bca22cb1d3cc5913c06ffbc5c499049d2588ec3170f838a091e6e8b74f66ead8bd47f664b9c8926220921fc8d
SSDEEP

3072:Eo3Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:zQ+IFCumUGekHRvEuO3go9kfnQ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 1724	1708	Bright_Past.exe	28
PID 1708 wrote to memory of 1724	1708	Bright_Past.exe	28
PID 1708 wrote to memory of 1724	1708	Bright_Past.exe	28

C:\Users\Admin\AppData\Local\Temp\Bright_Past.exe
"C:\Users\Admin\AppData\Local\Temp\Bright_Past.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1708 -s 56
  2⤵
  PID:1724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1708-0-0x0000000140000000-0x0000000140021000-memory.dmp

Filesize
132KB

Download