9f52a7ac90fff99eb407a0d377aed95920b7e62b492848e74f11fef5d59c7002 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 23:13

Sharing

Report Analysis Logs

General

Target

OwnCheat.exe
Size

462KB
MD5

adcf088bea6905d093229562ff62fee0
SHA1

e7b83c9844472d36a9e3eae60622626c51d76ea8
SHA256

9f52a7ac90fff99eb407a0d377aed95920b7e62b492848e74f11fef5d59c7002
SHA512

9b9ba4cdcacf0cd26b48a50f2eafec19b5e3e32adc07c4b8d7af3d1bfe836b39c4502bd9e1e616814f1d3adf272fc0421ac2a7e14b65f4a8a15a86db810ee79c
SSDEEP

12288:xdy0t/5TvlSRKJCyscfmiBYLRY7i4nzqjFdry:T/5jlZxmiYRR4Udr

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3036	2936	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 3036	2936	OwnCheat.exe	29
PID 2936 wrote to memory of 3036	2936	OwnCheat.exe	29
PID 2936 wrote to memory of 3036	2936	OwnCheat.exe	29
PID 2936 wrote to memory of 3036	2936	OwnCheat.exe	29

C:\Users\Admin\AppData\Local\Temp\OwnCheat.exe
"C:\Users\Admin\AppData\Local\Temp\OwnCheat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 36
  2⤵
  - Program crash
  PID:3036

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2936-0-0x0000000001014000-0x0000000001015000-memory.dmp

Filesize
4KB

Download