71ce71735aa47a3b1d17e1b6639aaf6213b4c284243ad5ae7bb36fa1c5c9975f

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 08:47

Target

SpyNote_v6.4/Resources/Imports/Payload/SL.exe
Size

1.5MB
MD5

f6a422a88819ddbea39c40a28fbdd307
SHA1

710fdbbd3d6f273bdc05bf4c3a0146b0142ad71e
SHA256

ebabf22b419f6a4b1fde570999f5871fb4f0552f4a97629f6ebf02edd33b8a2b
SHA512

42c6f6e92d0c3ec764017c69e1c52ced65944b45782b72ce586d4203acbbf39affb267a16314c30ec146cb8710c0e151c3db2a851100b8cf7bbcf800dbde3051
SSDEEP

768:rKSAOfhZXvSzjWKDIp93ZZwpZpTQdBHiF7QHsIMd3uDxZuFs+mg:9rfhZXvSzjWb5wz16S7l9eDxZuv

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

SL.exe

description	pid	process	target process
PID 1704 wrote to memory of 2336	1704	SL.exe	WerFault.exe
PID 1704 wrote to memory of 2336	1704	SL.exe	WerFault.exe
PID 1704 wrote to memory of 2336	1704	SL.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\SpyNote_v6.4\Resources\Imports\Payload\SL.exe
"C:\Users\Admin\AppData\Local\Temp\SpyNote_v6.4\Resources\Imports\Payload\SL.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1704

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1704 -s 788
2⤵
PID:2336

memory/1704-0-0x000007FEF6033000-0x000007FEF6034000-memory.dmp

Filesize
4KB

Download
memory/1704-1-0x00000000013A0000-0x000000000152C000-memory.dmp

Filesize
1.5MB

Download
memory/1704-2-0x000007FEF6030000-0x000007FEF6A1C000-memory.dmp

Filesize
9.9MB

Download
memory/1704-3-0x000007FEF6033000-0x000007FEF6034000-memory.dmp

Filesize
4KB

Download
memory/1704-4-0x000007FEF6030000-0x000007FEF6A1C000-memory.dmp

Filesize
9.9MB

Download