35a86f77fe2afc753a6ed72a51bd80753b8787075ee716d7594371d3764f5246 | Triage

Analysis

max time kernel
10s
max time network
18s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/02/2024, 16:39

Sharing

Report Analysis Logs

General

Target

vmconnect6.2.exe
Size

356KB
MD5

d919ba7116fdf60c100c02caee70b74c
SHA1

bdc031e750fdc5623b671195484783a4b22d6b03
SHA256

35a86f77fe2afc753a6ed72a51bd80753b8787075ee716d7594371d3764f5246
SHA512

b999016ebca8c531e54575dc1d0dd8405048f41c5e0b5ca62c5b32f2b36a3152e72b94f093a09b8f23f639b6ed2bd3fb30c13ea2ca13c2b2dd14542f7fff8cf1
SSDEEP

6144:+P7Z8bLmfqVGiePDFjGVp6terxFYtE0r0Y5:7kxvTh

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 2244	1308	vmconnect6.2.exe	28
PID 1308 wrote to memory of 2244	1308	vmconnect6.2.exe	28
PID 1308 wrote to memory of 2244	1308	vmconnect6.2.exe	28

C:\Users\Admin\AppData\Local\Temp\vmconnect6.2.exe
"C:\Users\Admin\AppData\Local\Temp\vmconnect6.2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1308 -s 520
  2⤵
  PID:2244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1308-0-0x000000013FB30000-0x000000013FB8C000-memory.dmp

Filesize
368KB

Download
memory/1308-1-0x000007FEF5300000-0x000007FEF5CEC000-memory.dmp

Filesize
9.9MB

Download