1b8b9c946aaa320f37bfe50d76460388574d16b0a390af4d68176d8620ac5641 | Triage

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 08:12

Sharing

Report Analysis Logs

General

Target

Posexchange.exe
Size

680KB
MD5

5f7393716c2b80ccc3f9c58a3d36f3ca
SHA1

875189ca60689a1639397cf57d92ff20f9a054cc
SHA256

1b8b9c946aaa320f37bfe50d76460388574d16b0a390af4d68176d8620ac5641
SHA512

d427ca8a76014fc86347cff22bbf96c05a87bbbdc74567e530eea26149397e9f1dbbd9a689448e24a41fb196a2820902f1a305afe1cbf22934023baec049bd07
SSDEEP

12288:IkGn0e5RPU45PCykAE47ghobtFxllNgFnOWjynXxRTMoR5rmgw:Ik60ezxgdr47g+btFflNaOWXoRtmgw

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2468	1720	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2468	1720	Posexchange.exe	28
PID 1720 wrote to memory of 2468	1720	Posexchange.exe	28
PID 1720 wrote to memory of 2468	1720	Posexchange.exe	28
PID 1720 wrote to memory of 2468	1720	Posexchange.exe	28

C:\Users\Admin\AppData\Local\Temp\Posexchange.exe
"C:\Users\Admin\AppData\Local\Temp\Posexchange.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 192
  2⤵
  - Program crash
  PID:2468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1720-0-0x0000000000400000-0x00000000005E5000-memory.dmp

Filesize
1.9MB

Download