08329d73b4f63b765278316cd979171012b4426ff75527da61b1443263b487bf | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-02-2024 23:31

Sharing

Report Analysis Logs

General

Target

lnjector.exe
Size

146.9MB
MD5

dafbb6d70ba2780bdc0c83ff7e5b4ad5
SHA1

35038e11db04eb355ae0ded47aa080757a590820
SHA256

08329d73b4f63b765278316cd979171012b4426ff75527da61b1443263b487bf
SHA512

9de7bfa5dfc6d64b813e8af9667612493f3fe3dea35c42d32ce833ab31015fedfa04635d8852be0e63a84846e034066fec13148072c0369992e570af9c54c529
SSDEEP

12288:Qd7i4jrv149y+q3eUn8N7unsFy0QB1Avt7G3c/pFj2TXHgCl2:+ru4TGYHA

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1336	1912	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 1336	1912	lnjector.exe	29
PID 1912 wrote to memory of 1336	1912	lnjector.exe	29
PID 1912 wrote to memory of 1336	1912	lnjector.exe	29
PID 1912 wrote to memory of 1336	1912	lnjector.exe	29

C:\Users\Admin\AppData\Local\Temp\lnjector.exe
"C:\Users\Admin\AppData\Local\Temp\lnjector.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 128
  2⤵
  - Program crash
  PID:1336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1912-0-0x00000000002E0000-0x0000000000329000-memory.dmp

Filesize
292KB

Download
memory/1912-5-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download