c4079adbd900f429976e7363d635dca803e7d244675263ebb30b1ea8fc889e29 | Triage

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 23:30

Sharing

Report Analysis Logs

General

Target

MakeSignature.exe
Size

1.5MB
MD5

65050987d23fc2645b902be63251c88e
SHA1

938402d9aa8984218cdf1ce2c7de10d743186522
SHA256

209dd4c6724dafd5efa5547ca539fb77577b3eb53e5b8f49880083e9b5654505
SHA512

028ae64d29f467602f99c37080c1aa2625c236417a1858153431c7196aa549c53521fdb95eb5602adb8d5bf304d6941f0901d3bd13dfd1a9dd09761c2d50bbb4
SSDEEP

24576:zxLYY39NI09KbSdGpDN3PKQ1bxnxigbhsdxT:dLYyIJSEpDVXl5xigbhWxT

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2908	2008	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2908	2008	MakeSignature.exe	28
PID 2008 wrote to memory of 2908	2008	MakeSignature.exe	28
PID 2008 wrote to memory of 2908	2008	MakeSignature.exe	28
PID 2008 wrote to memory of 2908	2008	MakeSignature.exe	28

C:\Users\Admin\AppData\Local\Temp\MakeSignature.exe
"C:\Users\Admin\AppData\Local\Temp\MakeSignature.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 412
  2⤵
  - Program crash
  PID:2908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2008-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2008-1-0x0000000000400000-0x0000000000577000-memory.dmp

Filesize
1.5MB

Download
memory/2008-3-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download