1bca3713ce29b2515d57f04fa578dd48376645844895f4e7c66c0d6e7c95da86 | Triage

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-04-2024 22:09

Sharing

Report Analysis Logs

General

Target

Codex/Codex.exe
Size

467KB
MD5

70f6d06865408e4ebecce19dab22ea8b
SHA1

7a5be2cd521dd1e51730f058db4a3a58288fdd8f
SHA256

80446b2068c39aed04c4af46d71013f5f2bd9f435cdae425a0a5c602def4fe74
SHA512

9632ac36a52fbf9ac09e4aaf33b13dd8047a66f76d3c3302b27b66fb63b54c2479c5b10ad41740461af45607dca7c8dfffdff7eef999ced62851e8928026aa5b
SSDEEP

12288:C0tmAIxuYBgt3BeqVXhEsbRejDfVbby7Mpt:9qw534gKsVe/tiwt

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1772 1968 WerFault.exe Codex.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Codex.exe

description	pid	process	target process
PID 1968 wrote to memory of 1772	1968	Codex.exe	WerFault.exe
PID 1968 wrote to memory of 1772	1968	Codex.exe	WerFault.exe
PID 1968 wrote to memory of 1772	1968	Codex.exe	WerFault.exe
PID 1968 wrote to memory of 1772	1968	Codex.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Codex\Codex.exe
"C:\Users\Admin\AppData\Local\Temp\Codex\Codex.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 120
  2⤵
  - Program crash
  PID:1772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1968-0-0x0000000000CA0000-0x0000000000D16000-memory.dmp

Filesize
472KB

Download