3a0cceed6e8ef493bdecc9f2988b2cfe86f6241478d8c9f7659eee71d7f170e2 | Triage

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-05-2024 22:46

Sharing

Report Analysis Logs

General

Target

yerp.exe
Size

67.0MB
MD5

c2e5647b65b787d5cd858f325bf2e79a
SHA1

557f8c636c42d60763bf13d9427b7e73ffa4cb04
SHA256

773366f9bb0e2fa751b86e7632ab1c6e0f3cfed4f9464b6b1adc10d056bc3714
SHA512

158cc8ce606d5a0c5266c1cdfc7077c7c5136cd79e5de5be5a8c6f2131eb0cc4a13d9ff47be51830842752a571fc65d8ee5b0f7781a364d088a34dd9ed670a53
SSDEEP

393216:zqCKJWr646m8GH5y4SVFY+L/I5glN7tFL+fzqdqhuQjPLzXok:zqCKJWr36PGZpSVFh/aglNpg7jPok

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

yerp.exe

pid process

2000 yerp.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

yerp.exe

description	pid	process	target process
PID 2000 wrote to memory of 2080	2000	yerp.exe	WerFault.exe
PID 2000 wrote to memory of 2080	2000	yerp.exe	WerFault.exe
PID 2000 wrote to memory of 2080	2000	yerp.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\yerp.exe
"C:\Users\Admin\AppData\Local\Temp\yerp.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2000 -s 192
  2⤵
  PID:2080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2000-1-0x000000013F4A0000-0x0000000143820000-memory.dmp

Filesize
67.5MB

Download