d420bbe330a69c299a563f112bf5723f0080c8533e1dbb62513159376bbe8c33 | Triage

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04-02-2024 01:13

Sharing

Report Analysis Logs

General

Target

AppFile_v1.1.exe
Size

2.7MB
MD5

8b1ab40c7362b992e571d6980f585ef0
SHA1

df8833bb710ead484f4faa63f95cafa7ffb08c54
SHA256

a3a5e7011335a2284e2d4f73fd464ff129f0c9276878a054c1932bc50608584b
SHA512

87a6553c9e57db4536b7c0312b1cf24071492f2c77f30d82bba34d50419819480c673d1886a9d9120ad2fba38887cd57225b23eab9e206373f23793b25c49353
SSDEEP

49152:e2rYDqbnu61UQxMfxVGOwMApIvhsD/eiUsQHGZXqKPRD:Pvnu6OHPwZNXqKPZ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 1244	1320	AppFile_v1.1.exe	28
PID 1320 wrote to memory of 1244	1320	AppFile_v1.1.exe	28
PID 1320 wrote to memory of 1244	1320	AppFile_v1.1.exe	28

C:\Users\Admin\AppData\Local\Temp\AppFile_v1.1.exe
"C:\Users\Admin\AppData\Local\Temp\AppFile_v1.1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1320 -s 196
  2⤵
  PID:1244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads