Analysis

  • max time kernel
    122s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    02/06/2024, 22:29

General

  • Target

    BypassReplacer-1.1.0.exe

  • Size

    27KB

  • MD5

    3a2cb456696831941f829530e14df19f

  • SHA1

    2db59f7183ed9d9b7497ab24a18340678619947d

  • SHA256

    b208ec0fe4639d109ce3ce28175540d93ace2b284326e8a7ea4e665d93c01866

  • SHA512

    a13be4ca47eb28f99047b6ae2eb4552039662a5bdbf8035f400501dd156f64f11f7d8c1bcd64d082fc9796a13721ccd01670e740731f5b5654fdd708d3045f9f

  • SSDEEP

    768:IRKZmQI9xyAIigqfsrGU2WXFcYcV69izh:I7txyAIi7uF069iz

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BypassReplacer-1.1.0.exe
    "C:\Users\Admin\AppData\Local\Temp\BypassReplacer-1.1.0.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2420
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 2420 -s 640
      2⤵
        PID:2936

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2420-0-0x000007FEF52E3000-0x000007FEF52E4000-memory.dmp

      Filesize

      4KB

    • memory/2420-1-0x000000013FFC0000-0x000000013FFCA000-memory.dmp

      Filesize

      40KB

    • memory/2420-2-0x000007FEF52E0000-0x000007FEF5CCC000-memory.dmp

      Filesize

      9.9MB

    • memory/2420-3-0x000007FEF52E3000-0x000007FEF52E4000-memory.dmp

      Filesize

      4KB

    • memory/2420-4-0x000007FEF52E0000-0x000007FEF5CCC000-memory.dmp

      Filesize

      9.9MB