c62a0077a7148ff74491708bccd41dd596fc8386079dae98cc7975946f2487be | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-05-2024 11:58

Sharing

Report Analysis Logs

General

Target

SpaceInfo.exe
Size

18KB
MD5

9ec347d430191a37aab0b36ab8ae047d
SHA1

a18f44a6c0e1f1f8d53ff7d4b9f8328729705f48
SHA256

c62a0077a7148ff74491708bccd41dd596fc8386079dae98cc7975946f2487be
SHA512

539be93eef23a3a470bad789ad45f5c76bd969f9c29d5330a8f0c8c9e69b070ea5fafe80dcc17581b91ad471ca55d30b846152b51ec8e6bff99a990c9f68c511
SSDEEP

384:KRZorWMCvINo6uNysLaau6udj4L3LKLswgIB0ffa0:KRZorWhvgo6KltXbWUIBSF

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1992	2964	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 1992	2964	SpaceInfo.exe	28
PID 2964 wrote to memory of 1992	2964	SpaceInfo.exe	28
PID 2964 wrote to memory of 1992	2964	SpaceInfo.exe	28
PID 2964 wrote to memory of 1992	2964	SpaceInfo.exe	28

C:\Users\Admin\AppData\Local\Temp\SpaceInfo.exe
"C:\Users\Admin\AppData\Local\Temp\SpaceInfo.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 604
  2⤵
  - Program crash
  PID:1992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2964-0-0x0000000073F5E000-0x0000000073F5F000-memory.dmp

Filesize
4KB

Download
memory/2964-1-0x0000000000F70000-0x0000000000F7C000-memory.dmp

Filesize
48KB

Download
memory/2964-2-0x0000000073F50000-0x000000007463E000-memory.dmp

Filesize
6.9MB

Download