f320d97175b6caf764ac055219734f125995fb2847e26a37865b3c23457bb054 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 14:18

Sharing

Report Analysis Logs

General

Target

Crack/DrivePool.Service.exe
Size

7.0MB
MD5

8b2c6f371cd24ccbedae6cc58d3ef479
SHA1

5af71252d7a44e3a2f172ed261ebf6afbe963fbb
SHA256

678160fa9f3eac5644c5752352fdb4f231551055661fb274f778a27d35f281ae
SHA512

052a572b9ec31cde4e3ce91542b15ed29ed0ab3ac1f7a87ccc8c87248c6955427ce7d8fa615f1d901ca1cfc342932ca408617fd378d987c964f7dd67af9558d7
SSDEEP

49152:zuktSG6NIW7Oyvoqg4BOBJ7BwZZCW5MoYsgNZc6yD4us:zukLZc6ysj

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 3024	2388	DrivePool.Service.exe	28
PID 2388 wrote to memory of 3024	2388	DrivePool.Service.exe	28
PID 2388 wrote to memory of 3024	2388	DrivePool.Service.exe	28

C:\Users\Admin\AppData\Local\Temp\Crack\DrivePool.Service.exe
"C:\Users\Admin\AppData\Local\Temp\Crack\DrivePool.Service.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2388 -s 500
  2⤵
  PID:3024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2388-0-0x000007FEF5AB3000-0x000007FEF5AB4000-memory.dmp

Filesize
4KB

Download
memory/2388-1-0x0000000000F30000-0x000000000163A000-memory.dmp

Filesize
7.0MB

Download
memory/2388-2-0x000007FEF5AB0000-0x000007FEF649C000-memory.dmp

Filesize
9.9MB

Download