0fb8ea1ca1ea8aab5ab5797c11e0d0a4bf12103a6acbf2014e1836b35788183f | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
18/02/2024, 00:34

Sharing

Report Analysis Logs

General

Target

sharp.exe
Size

9.8MB
MD5

933af071c1afade46438939b27806ed4
SHA1

3d313c046d4e601e421c923148c7127d9b69ade8
SHA256

0fb8ea1ca1ea8aab5ab5797c11e0d0a4bf12103a6acbf2014e1836b35788183f
SHA512

d5bd8c63d4ee2fe1eae6f6c2695f652340d03634c3acded4d674e59f1401efa5e22b12e9228d838a932aa396b9f156166976581ce43fcd613e291e120a0288de
SSDEEP

196608:LUye3EbT9bwiIHa3Q7CezjQ7MKpa9BJB6ZX7LkqadqGLno/:Be0/y+e0npa9neXvkqaMGjo/

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2380	2888	sharp.exe	29
PID 2888 wrote to memory of 2380	2888	sharp.exe	29
PID 2888 wrote to memory of 2380	2888	sharp.exe	29

C:\Users\Admin\AppData\Local\Temp\sharp.exe
"C:\Users\Admin\AppData\Local\Temp\sharp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2888 -s 100
  2⤵
  PID:2380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads