04e44918f2cdd2b07000e1551296ae3e345cfa3eb34d682646920aeab257b85c | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 12:36

Sharing

Report Analysis Logs

General

Target

名单册-终端o.exe
Size

878KB
MD5

62742870a22f597230c561f4c1339bf2
SHA1

b361a8441474b7f58c84a625bc500c1637da0d4f
SHA256

bc61632be930cc0d4037e10617ef1c86c7c0da630a362566cd960507a5251877
SHA512

8ed1eec393bbdf5fe4652cee80361714c5a70af1434e95ff7d7a0584d7ea93389e7b99146af1a878c34d4f7a24232ce73f282596b0fbb31ade6dc253638c4c69
SSDEEP

12288:x8ov/AoJiq/2Erig84ptXj6Zh/yeYOcUekIANrxSXwfBF0EAxkpkk/:a+l2kiiptz/eYOcCEXwfBF0

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

名单册-终端o.exe

pid process

2236 名单册-终端o.exe
2236 名单册-终端o.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

名单册-终端o.exe

description	pid	process	target process
PID 2236 wrote to memory of 2288	2236	名单册-终端o.exe	WerFault.exe
PID 2236 wrote to memory of 2288	2236	名单册-终端o.exe	WerFault.exe
PID 2236 wrote to memory of 2288	2236	名单册-终端o.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\名单册-终端o.exe
"C:\Users\Admin\AppData\Local\Temp\名单册-终端o.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2236 -s 720
2⤵
PID:2288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2236-0-0x0000000001CC0000-0x0000000001CC1000-memory.dmp

Filesize
4KB

Download