e92cdbbe48126dbb28f80649a8ae2b4830afa44f463bd5ee8d9864cba6895b69 | Triage

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 18:39

Sharing

Report Analysis Logs

General

Target

NewSetup.exe
Size

484KB
MD5

e37878f91225a2846fba65860ea3d8de
SHA1

32dff811ff4cc8bd14f5ead35f24fbd727d27e02
SHA256

e92cdbbe48126dbb28f80649a8ae2b4830afa44f463bd5ee8d9864cba6895b69
SHA512

bf0ed82137406e2cd8bbe8dd822f14a7833943f9ef82ac3841348f1da64b6c4fb78a5c8cc92bf8d27a3d0cf4718b71570692d60bafb347e1b1562cfe4d82a486
SSDEEP

12288:ldy0t/5TvlFif21MxY2tT9w9v2OBYuOG57y:P/5jl49xY0wJYD6

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1676	2192	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 1676	2192	NewSetup.exe	29
PID 2192 wrote to memory of 1676	2192	NewSetup.exe	29
PID 2192 wrote to memory of 1676	2192	NewSetup.exe	29
PID 2192 wrote to memory of 1676	2192	NewSetup.exe	29

C:\Users\Admin\AppData\Local\Temp\NewSetup.exe
"C:\Users\Admin\AppData\Local\Temp\NewSetup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 36
  2⤵
  - Program crash
  PID:1676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2192-0-0x0000000000A20000-0x0000000000A9E000-memory.dmp

Filesize
504KB

Download