68b9e9ea30f8fac69af9ecdd10d6acad6aff34d31af477707da9c24c473014ec | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 00:20

Sharing

Report Analysis Logs

General

Target

MendalWare.exe
Size

271KB
MD5

bfa0c95a1979a02d5538b4bc1a0de206
SHA1

e0fead0995f10fde925f872197d970d55a2a7796
SHA256

68b9e9ea30f8fac69af9ecdd10d6acad6aff34d31af477707da9c24c473014ec
SHA512

8ca8e4fc1693c45da44971bc877c82858efc7a1bc78a99283c410c6bfb78807b8d91f6dcf4651ce574d2696162bdd4fc93a87e9b3fda1a17176a58e46af57b78
SSDEEP

6144:ydBHmreQ6feAVfbDn+xSNBf+kg5KoT1JAnvq8cW2rWnN3MsWD:lAfbDRNu5KoT1J6q8ioN3MDD

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1204	2276	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 1204	2276	MendalWare.exe	28
PID 2276 wrote to memory of 1204	2276	MendalWare.exe	28
PID 2276 wrote to memory of 1204	2276	MendalWare.exe	28
PID 2276 wrote to memory of 1204	2276	MendalWare.exe	28

C:\Users\Admin\AppData\Local\Temp\MendalWare.exe
"C:\Users\Admin\AppData\Local\Temp\MendalWare.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 324
  2⤵
  - Program crash
  PID:1204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads