3f8c1c1c699e7f82d69858c926e67d8f5c66064bf1d9372a503ab1f2db83e075 | Triage

Resubmissions

31/05/2024, 20:12

240531-yyv4nabf8x 3

31/05/2024, 20:05

240531-ytz7tabe5v 3

Analysis

max time kernel
15s
max time network
16s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 20:05

Sharing

Report Analysis Logs

General

Target

LoSeSb.exe
Size

102KB
MD5

eaf41fcf0374f443b2063ace39276749
SHA1

5d27d2577b6fb5db5e1f3b0c913c31b28dab312e
SHA256

3f8c1c1c699e7f82d69858c926e67d8f5c66064bf1d9372a503ab1f2db83e075
SHA512

78d40f325ca5bee4f20eb19d8a2c5aa2ced8a14ba200aa7e480bdc6d5f2d4a4e40f278db90d120dfde004bc94da8342fc77793dcb70508bb1e90b1cd89c6a60e
SSDEEP

3072:Z3Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:VQ+IFCumUGekHRvEuO3go9kfnQ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2368	2320	LoSeSb.exe	28
PID 2320 wrote to memory of 2368	2320	LoSeSb.exe	28
PID 2320 wrote to memory of 2368	2320	LoSeSb.exe	28

C:\Users\Admin\AppData\Local\Temp\LoSeSb.exe
"C:\Users\Admin\AppData\Local\Temp\LoSeSb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2320 -s 56
  2⤵
  PID:2368

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads