b06484457fac9078aff0b7daef89cbc30d155023313d172045775e28b67e7ebd | Triage

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2024, 02:22

Sharing

Report Analysis Logs

General

Target

RunMePls‮gpj.exe
Size

13.6MB
MD5

bc5b47d8c43fa4fcb52876e92e796b42
SHA1

4ef1cbe3b6834af2080b06d379f43df7d898421d
SHA256

b06484457fac9078aff0b7daef89cbc30d155023313d172045775e28b67e7ebd
SHA512

00e89b63b0264235eb9f04dcee2cf75222fced4bcf6564aa4cbee9ff78e4bdc16497ad3b00cd16e7cbc2d442513e187aae6e286bbaef27554ea8c2f5d79d318d
SSDEEP

393216:orgbHdc3QjfclgA/BOWkDRrCYV4BHtW/BZo1:orgRcgrwOWXY8AZo

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
220	3992	WerFault.exe	89

Suspicious behavior: RenamesItself 5 IoCs

pid	Process
3528	RunMePls‮gpj.exe
3528	RunMePls‮gpj.exe
3528	RunMePls‮gpj.exe
3992	RunMePls.gpj.exe
3992	RunMePls.gpj.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 3992	3528	RunMePls‮gpj.exe	89
PID 3528 wrote to memory of 3992	3528	RunMePls‮gpj.exe	89
PID 3528 wrote to memory of 3992	3528	RunMePls‮gpj.exe	89

C:\Users\Admin\AppData\Local\Temp\RunMePls‮gpj.exe
"C:\Users\Admin\AppData\Local\Temp\RunMePls‮gpj.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Users\Admin\AppData\Local\Temp\RunMePls.gpj.exe
  C:\Users\Admin\AppData\Local\Temp\RunMePls.gpj.exe
  2⤵
  - Suspicious behavior: RenamesItself
  PID:3992
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 740
    3⤵
    - Program crash
    PID:220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3992 -ip 3992
1⤵
PID:3716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3528-0-0x0000000002F70000-0x0000000002F76000-memory.dmp

Filesize
24KB

Download