ba00fdc92ceaa66612cda52a770bda7961f8cee511e714b6db208583e9f40729 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04-06-2024 20:03

Sharing

Report Analysis Logs

General

Target

install-x86.exe
Size

305.4MB
MD5

0435a86a984c46c27a96f0ef45c8f195
SHA1

17a5002a1ab8e5acbcc7a04cd329704b400ec403
SHA256

96512386ea92612cd3c09c377f6a62e1df7a940ce4e46ca5562d75a1017413c9
SHA512

9cd1857e2ea563abf6da90fe60f70795605aa64c221d4bdbc306f43c80e9620e7ffbfa9a6cc045b595d7a33b398802239e24de82314b3c820762fdd419a9a276
SSDEEP

24576:xLnvOkez722EygnXQWoooooooooooooooooooooooooooooooooooooooooooooD:xbJ/S

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

install-x86.exe

description	pid	process	target process
PID 1656 wrote to memory of 1932	1656	install-x86.exe	WerFault.exe
PID 1656 wrote to memory of 1932	1656	install-x86.exe	WerFault.exe
PID 1656 wrote to memory of 1932	1656	install-x86.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\install-x86.exe
"C:\Users\Admin\AppData\Local\Temp\install-x86.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1656 -s 532
  2⤵
  PID:1932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1656-0-0x000007FEF5753000-0x000007FEF5754000-memory.dmp

Filesize
4KB

Download
memory/1656-1-0x000000013FAE0000-0x0000000140AE0000-memory.dmp

Filesize
16.0MB

Download
memory/1656-2-0x000007FEF5753000-0x000007FEF5754000-memory.dmp

Filesize
4KB

Download