a87783ad0039596d5d0c4086470fe158c08157772605cf0d80961694d3341e99 | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

PasteUp106.exe
Size

2.8MB
MD5

432238f8bd67ee07af2369f6a2faefdf
SHA1

270d1ad3087dbb184e23f2f6b183c9b76aea1515
SHA256

a87783ad0039596d5d0c4086470fe158c08157772605cf0d80961694d3341e99
SHA512

1287a297e9ff9ffc71aa11636ff9b1ca4903bd04c59382d46a8081211f255e5691cfacbeb96cd6b2f4d0241867c50a33f8c2a461f759a9a334a074a67b507f73
SSDEEP

49152:3cpCW9wF0HINIkb0eFJ8sp7x4wGUka08uYYamQ72:K9wFzz0RspFd6P8uamc

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2668	1936	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2668	1936	PasteUp106.exe	28
PID 1936 wrote to memory of 2668	1936	PasteUp106.exe	28
PID 1936 wrote to memory of 2668	1936	PasteUp106.exe	28
PID 1936 wrote to memory of 2668	1936	PasteUp106.exe	28

C:\Users\Admin\AppData\Local\Temp\PasteUp106.exe
"C:\Users\Admin\AppData\Local\Temp\PasteUp106.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 544
  2⤵
  - Program crash
  PID:2668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1936-1-0x0000000000E50000-0x000000000111C000-memory.dmp

Filesize
2.8MB

Download
memory/1936-0-0x0000000074BD0000-0x00000000752BE000-memory.dmp

Filesize
6.9MB

Download
memory/1936-2-0x0000000074BD0000-0x00000000752BE000-memory.dmp

Filesize
6.9MB

Download