a3c3f7a0014e41ff435db5b87ec92e60ada72a94fc401cb1ef3cf6daf71630e1 | Triage

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 13:19

Sharing

Report Analysis Logs

General

Target

Anycast.exe
Size

1.4MB
MD5

df90ed2b8d1c23a3ad6a8338bfe4a9c6
SHA1

b02dc10c8cfde967f621ee490ec8c0186d4d505e
SHA256

14fb8abaa99c742fa685871c39874348433888da5ce5cf6f4656e99ffe99497a
SHA512

b138e53c2f132071994b92c97d2ab3f6e7bee10d5794cf2550b6ab318c053b41b959a11e4da3d446075ab4bf96ebd3f55a3cba2457089c65b015d2684ac98931
SSDEEP

24576:xLRHAgfSVJbyeUyUCiWx6drqLwU6H/544tbp+pa40vK1f43kwBa:zvubRHnxm+F6f+4hQY40S1fD

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3028	2616	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 3028	2616	Anycast.exe	28
PID 2616 wrote to memory of 3028	2616	Anycast.exe	28
PID 2616 wrote to memory of 3028	2616	Anycast.exe	28
PID 2616 wrote to memory of 3028	2616	Anycast.exe	28

C:\Users\Admin\AppData\Local\Temp\Anycast.exe
"C:\Users\Admin\AppData\Local\Temp\Anycast.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 544
  2⤵
  - Program crash
  PID:3028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2616-1-0x0000000074950000-0x000000007503E000-memory.dmp

Filesize
6.9MB

Download
memory/2616-0-0x00000000003F0000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/2616-2-0x0000000074950000-0x000000007503E000-memory.dmp

Filesize
6.9MB

Download