e0bc4f6bddc8eed8801ff23a921559aff7c3d16d131441ea27d0702c9c9818ec | Triage

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 12:30

Sharing

Report Analysis Logs

General

Target

boss.exe
Size

439KB
MD5

7d0f3d9a9bc6b47ec1ac4cc94af65a22
SHA1

816e29273ce1b4aef292daaa86fe3d0ec72a9fe6
SHA256

e0bc4f6bddc8eed8801ff23a921559aff7c3d16d131441ea27d0702c9c9818ec
SHA512

93b49989475073ad39fe7ec7ca0f5cacb75123b42d6634ad0ea02d2b1ca8c2a8e2116578c80862493adb489944033244c236baa7acfaee9fdfd0ff84a1cee640
SSDEEP

6144:wjCSLtrDdIZG2nqJElpL3im9+3Kz9BngKbtPLLd5MJDDo552:CCS96TnSEl1yt6zzng0L1E

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 1724	2752	boss.exe	28
PID 2752 wrote to memory of 1724	2752	boss.exe	28
PID 2752 wrote to memory of 1724	2752	boss.exe	28

C:\Users\Admin\AppData\Local\Temp\boss.exe
"C:\Users\Admin\AppData\Local\Temp\boss.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2752 -s 516
  2⤵
  PID:1724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2752-0-0x000000013F600000-0x000000013F670000-memory.dmp

Filesize
448KB

Download
memory/2752-1-0x000007FEF5710000-0x000007FEF60FC000-memory.dmp

Filesize
9.9MB

Download
memory/2752-2-0x000007FEF5710000-0x000007FEF60FC000-memory.dmp

Filesize
9.9MB

Download