c98f4135f4c4eaf6e0ee4c0cbfce4682b1f45026df74c0d015b62b69da9674b1 | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/03/2024, 12:41

Sharing

Report Analysis Logs

General

Target

BQkrRFZe.exe
Size

58KB
MD5

1c759ea6f86b05ee9837c66fc35d8fbd
SHA1

0384bdc41ecdd84ad480ed0f93c17e5f01d54563
SHA256

c98f4135f4c4eaf6e0ee4c0cbfce4682b1f45026df74c0d015b62b69da9674b1
SHA512

a6a5406ed410a29d183c3a60af92148c35aecb0f4edd89a39198b979d71af4794146f96950cf3929c1ebd03af1e18dab847dd35aa2368d2d21f790e29334e303
SSDEEP

768:NiHaGmJqj/DkKqn5FKwQE8IWlReWfDWf9zTjaCuGiyqFdQ:NWfqqj/DMFv8I8ReUWflaCoFdQ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2324	2796	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 2324	2796	BQkrRFZe.exe	29
PID 2796 wrote to memory of 2324	2796	BQkrRFZe.exe	29
PID 2796 wrote to memory of 2324	2796	BQkrRFZe.exe	29
PID 2796 wrote to memory of 2324	2796	BQkrRFZe.exe	29

C:\Users\Admin\AppData\Local\Temp\BQkrRFZe.exe
"C:\Users\Admin\AppData\Local\Temp\BQkrRFZe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 52
  2⤵
  - Program crash
  PID:2324

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads