d30e33e5f4ec42d96e1641697f3141fcd7f1f8fe8db9301fc72b540ba789f082 | Triage

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 00:50

Sharing

Report Analysis Logs

General

Target

Voicemod V2.48/VoicemodSetup.exe
Size

493KB
MD5

bf8be626b9b471fa8d28a8eaf8a318f9
SHA1

d0b706240de97d48fd5442332c712db171d545b5
SHA256

a079900bde437ddbcffacc5d40dcce4ce383699f9d2fa0a4cf43ba4de601e512
SHA512

8da64569135c48b306fac8ae9c9b2daaa0bfa05bcf99605a1dedb4653c983a3ad0465b5f5291a73badba2394b0b34c221bb93ba15aa6a527c8d034fffcbc0bf1
SSDEEP

12288:+0zit5bNErysNGJunuh30tXd2n50V+srAWSmGaFoCe:PitBNY4onuhqd20dkwuR

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2096 2340 WerFault.exe VoicemodSetup.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

VoicemodSetup.exe

description	pid	process	target process
PID 2340 wrote to memory of 2096	2340	VoicemodSetup.exe	WerFault.exe
PID 2340 wrote to memory of 2096	2340	VoicemodSetup.exe	WerFault.exe
PID 2340 wrote to memory of 2096	2340	VoicemodSetup.exe	WerFault.exe
PID 2340 wrote to memory of 2096	2340	VoicemodSetup.exe	WerFault.exe
PID 2340 wrote to memory of 2096	2340	VoicemodSetup.exe	WerFault.exe
PID 2340 wrote to memory of 2096	2340	VoicemodSetup.exe	WerFault.exe
PID 2340 wrote to memory of 2096	2340	VoicemodSetup.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Voicemod V2.48\VoicemodSetup.exe
"C:\Users\Admin\AppData\Local\Temp\Voicemod V2.48\VoicemodSetup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 256
  2⤵
  - Program crash
  PID:2096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads