1b8ebdff61743c53f8ea561487e6f6d71d55a9c93660300a392e7f4b5179d8a4 | Triage

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
06-06-2024 08:36

Sharing

Report Analysis Logs

General

Target

install-x86.exe
Size

305.4MB
MD5

0435a86a984c46c27a96f0ef45c8f195
SHA1

17a5002a1ab8e5acbcc7a04cd329704b400ec403
SHA256

96512386ea92612cd3c09c377f6a62e1df7a940ce4e46ca5562d75a1017413c9
SHA512

9cd1857e2ea563abf6da90fe60f70795605aa64c221d4bdbc306f43c80e9620e7ffbfa9a6cc045b595d7a33b398802239e24de82314b3c820762fdd419a9a276
SSDEEP

24576:xLnvOkez722EygnXQWoooooooooooooooooooooooooooooooooooooooooooooD:xbJ/S

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

install-x86.exe

description	pid	process	target process
PID 2936 wrote to memory of 2948	2936	install-x86.exe	WerFault.exe
PID 2936 wrote to memory of 2948	2936	install-x86.exe	WerFault.exe
PID 2936 wrote to memory of 2948	2936	install-x86.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\install-x86.exe
"C:\Users\Admin\AppData\Local\Temp\install-x86.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2936 -s 528
  2⤵
  PID:2948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2936-0-0x000007FEF5EE3000-0x000007FEF5EE4000-memory.dmp

Filesize
4KB

Download
memory/2936-1-0x000000013FC70000-0x0000000140C70000-memory.dmp

Filesize
16.0MB

Download
memory/2936-2-0x000007FEF5EE3000-0x000007FEF5EE4000-memory.dmp

Filesize
4KB

Download