9593415e3c59bccf5b942204c21bf3b60b727868cd9bbd28efa10b045f838d7f | Triage

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-02-2024 03:32

Sharing

Report Analysis Logs

General

Target

valoskin/spoofer.exe
Size

425KB
MD5

168d7b4ca5c63b61d5f48f0911868b2c
SHA1

daf966bd0ac55c862ce5574ee7d5420123ac94e4
SHA256

601c05bd2d1c908d123dac33d1c15552c138acb294124cbdd86b12c9f35e2655
SHA512

da5ebb40849fedafc5a3ac7c48a0142c6eb5ccefe788b6c07491a757aa9e9b4f3d8b76e1dacf0600a833aade05c309b9661e8fd40080d4ba8f4cf4ea3d59900f
SSDEEP

12288:jLJ/KPJxO9j7MIFyKz3mBEP5KpPbDC0dGhKcYtmS2:jcPYsIUOwtb1whlt

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2752	1724	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2752	1724	spoofer.exe	29
PID 1724 wrote to memory of 2752	1724	spoofer.exe	29
PID 1724 wrote to memory of 2752	1724	spoofer.exe	29
PID 1724 wrote to memory of 2752	1724	spoofer.exe	29

C:\Users\Admin\AppData\Local\Temp\valoskin\spoofer.exe
"C:\Users\Admin\AppData\Local\Temp\valoskin\spoofer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 128
  2⤵
  - Program crash
  PID:2752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1724-0-0x0000000000780000-0x00000000007C9000-memory.dmp

Filesize
292KB

Download
memory/1724-5-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download