e1c7d09afcada193579ac21b5e3c3ab9eb710576ebc835358add821ddde3a139 | Triage

Resubmissions

10/04/2024, 19:54

240410-ymkhsadb4z 3

10/04/2024, 19:53

240410-yl6pmadb4s 3

Analysis

max time kernel
14s
max time network
4s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 19:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

TotalDramaHarem.exe
Size

104KB
MD5

85edd39151d85c0c2a0c5f640ff2f44e
SHA1

0a899342f0adca93d82a09c10c0b634db3492781
SHA256

e1c7d09afcada193579ac21b5e3c3ab9eb710576ebc835358add821ddde3a139
SHA512

46c5c4d131de248b7334280e9d0adf5b3659f6eea2e23a33eab94a0253f7d1c567cbaf3a480d8027dd601888a9e62a17bad3c0a9132f2211ed1686ea4f26b76c
SSDEEP

3072:NL3Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:ZQ+IFCumUGekHRvEuO3go9kfnQ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2904	2876	TotalDramaHarem.exe	28
PID 2876 wrote to memory of 2904	2876	TotalDramaHarem.exe	28
PID 2876 wrote to memory of 2904	2876	TotalDramaHarem.exe	28

C:\Users\Admin\AppData\Local\Temp\TotalDramaHarem.exe
"C:\Users\Admin\AppData\Local\Temp\TotalDramaHarem.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2876 -s 56
  2⤵
  PID:2904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2876-0-0x0000000140000000-0x0000000140021000-memory.dmp

Filesize
132KB

Download