5d8813c8888c16b7fd0a4a71b54b2037cb12570ee9ef96d50cfacb4c7bfe926e | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 00:27

Sharing

Report Analysis Logs

General

Target

OwnCheat.exe
Size

524KB
MD5

59e24336505eff626ece7419c9314d1e
SHA1

70c4294e910f9e2980c45989c349c625a9fb82b0
SHA256

5d8813c8888c16b7fd0a4a71b54b2037cb12570ee9ef96d50cfacb4c7bfe926e
SHA512

4602d33d9c73f135ff29ecfc4966f72c44a10428c49d2bb77714ccca0792b1ea9e5aaa250ebc1717c8051296d2b37cbd8c6744a42d2b934c0acfdb360a7b4050
SSDEEP

12288:uKVvbfv5NToZQRDJV4hNAsDGrakzBP666juEO:rD5N8kP4hNAsK22P666jut

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2224	2908	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2224	2908	OwnCheat.exe	28
PID 2908 wrote to memory of 2224	2908	OwnCheat.exe	28
PID 2908 wrote to memory of 2224	2908	OwnCheat.exe	28
PID 2908 wrote to memory of 2224	2908	OwnCheat.exe	28

C:\Users\Admin\AppData\Local\Temp\OwnCheat.exe
"C:\Users\Admin\AppData\Local\Temp\OwnCheat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 128
  2⤵
  - Program crash
  PID:2224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2908-0-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download