2ad0f1e6aeeca47a188a04a5c858f7ef72e4449123d412d095844ee271622356 | Triage

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20-02-2024 23:16

Sharing

Report Analysis Logs

General

Target

AppInstaller.exe
Size

313.0MB
MD5

6fd76fa67e9ec8390e685a3448263fd9
SHA1

c81f1df0c44c0d729b0111428e846875a40170aa
SHA256

2ad0f1e6aeeca47a188a04a5c858f7ef72e4449123d412d095844ee271622356
SHA512

b66da387d031903815780dffeeb94b88366728599fa92ac8b8b47336c29f4f73e20b21d44f58abf4d9b667643e40a53155f52159726c6694b891434d1a97be05
SSDEEP

49152:V61dzQ1n9ZKWf6yP6vnG8lP2JONqf0rjPCa5s4oGhpp:4pp

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2912	2908	AppInstaller.exe	28
PID 2908 wrote to memory of 2912	2908	AppInstaller.exe	28
PID 2908 wrote to memory of 2912	2908	AppInstaller.exe	28

C:\Users\Admin\AppData\Local\Temp\AppInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\AppInstaller.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2908 -s 532
  2⤵
  PID:2912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2908-0-0x000007FEF5D70000-0x000007FEF675C000-memory.dmp

Filesize
9.9MB

Download
memory/2908-1-0x000000013FC70000-0x0000000140C70000-memory.dmp

Filesize
16.0MB

Download
memory/2908-2-0x000007FEF5D70000-0x000007FEF675C000-memory.dmp

Filesize
9.9MB

Download