83af52150d2c570afc1d3e9db129e2a9d8de70dada92366780e0a52c7fd74b95 | Triage

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 18:18

Sharing

Report Analysis Logs

General

Target

RoweHack/RoweHack.exe
Size

425KB
MD5

69774d70b2248e0631900882dc3d3917
SHA1

2a3358e394448c079db91a3ce6caaf95858b30c9
SHA256

e1df7ba2f9ea92df5649a3efea3847eab44a71fe9984259b91f251e1d2500c57
SHA512

aac851f2fb68a01d52f8c204a73f5c20b3465bc4fb60f20505df063ee6afaa9b1444f1ab3aaec91261ca354bc5e392a41944108e55665331a39771c00530843d
SSDEEP

12288:ceYYA0dhj9KUwv9DKF1tHrIzOC3KKetMl1gHe:207wP8F1REzKKetMB

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2088 2208 WerFault.exe RoweHack.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

RoweHack.exe

description	pid	process	target process
PID 2208 wrote to memory of 2088	2208	RoweHack.exe	WerFault.exe
PID 2208 wrote to memory of 2088	2208	RoweHack.exe	WerFault.exe
PID 2208 wrote to memory of 2088	2208	RoweHack.exe	WerFault.exe
PID 2208 wrote to memory of 2088	2208	RoweHack.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\RoweHack\RoweHack.exe
"C:\Users\Admin\AppData\Local\Temp\RoweHack\RoweHack.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 48
2⤵
- Program crash
PID:2088

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2208-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2208-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download