8153bb95adb4716e96e8fe87ff64d9fbf52735fb75f09a1c49401293004b919a | Triage

Resubmissions

09-02-2024 14:10

240209-rgz8qabg9t 1

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09-02-2024 14:10

Sharing

Report Analysis Logs

General

Target

AppPack_v1.1.exe
Size

2.7MB
MD5

8b1ab40c7362b992e571d6980f585ef0
SHA1

df8833bb710ead484f4faa63f95cafa7ffb08c54
SHA256

a3a5e7011335a2284e2d4f73fd464ff129f0c9276878a054c1932bc50608584b
SHA512

87a6553c9e57db4536b7c0312b1cf24071492f2c77f30d82bba34d50419819480c673d1886a9d9120ad2fba38887cd57225b23eab9e206373f23793b25c49353
SSDEEP

49152:e2rYDqbnu61UQxMfxVGOwMApIvhsD/eiUsQHGZXqKPRD:Pvnu6OHPwZNXqKPZ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 1124	1044	AppPack_v1.1.exe	28
PID 1044 wrote to memory of 1124	1044	AppPack_v1.1.exe	28
PID 1044 wrote to memory of 1124	1044	AppPack_v1.1.exe	28

C:\Users\Admin\AppData\Local\Temp\AppPack_v1.1.exe
"C:\Users\Admin\AppData\Local\Temp\AppPack_v1.1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1044 -s 196
  2⤵
  PID:1124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads