f11704cbc14e2941ab7f571e5fcc5cf59d198a51055bad5109e6e1ea00f81015 | Triage

Analysis

max time kernel
2s
max time network
3s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/02/2024, 12:29

Sharing

Report Analysis Logs

General

Target

helloworld.exe
Size

3KB
MD5

bb084d7b224f7b8182182500309fed3e
SHA1

12f92ccd4a3d1b8a931fe5f0e6984d8ff38a07fd
SHA256

f11704cbc14e2941ab7f571e5fcc5cf59d198a51055bad5109e6e1ea00f81015
SHA512

f584e6b589d9c576158d2ba19ac1c9043098bf85b4469781035bcee581e181232b5931cf4871eb53d509006248707168f9907c29fdde0510a650e98c09676182

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 2660	1332	helloworld.exe	29
PID 1332 wrote to memory of 2660	1332	helloworld.exe	29
PID 1332 wrote to memory of 2660	1332	helloworld.exe	29

C:\Users\Admin\AppData\Local\Temp\helloworld.exe
"C:\Users\Admin\AppData\Local\Temp\helloworld.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1332 -s 32
  2⤵
  PID:2660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads