Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    13/06/2024, 03:34

General

  • Target

    Driver4VR.exe

  • Size

    179KB

  • MD5

    65a40a40099a5996ab2f54a0aa229a47

  • SHA1

    0d68f0ffa9a212fcf159bdb0dae62cd8b92b0bea

  • SHA256

    92e7fb4704d66e923f1367d68f633adddceb675ef943833be40bf2c2a7fc8543

  • SHA512

    c8a7e67dfce514e638c8e3140ca7bbfd293b19487f59a0ca6ba31373699f50606982ea3516d6db1037012f63c699dcc229a5fe2e5e10f3d4497713c3e2fa0f72

  • SSDEEP

    3072:hen7CeNZvE6Q3WyIuPmkJFaEnrOjkgxwlHg+sogeofPhdvU93thKoiXDMKmbprgk:henmeaGy3POEn+kgxwxg+sogqiXgtp7Z

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Driver4VR.exe
    "C:\Users\Admin\AppData\Local\Temp\Driver4VR.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2748
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 2748 -s 624
      2⤵
        PID:3020

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2748-0-0x000007FEF5783000-0x000007FEF5784000-memory.dmp

      Filesize

      4KB

    • memory/2748-1-0x000000013F420000-0x000000013F44E000-memory.dmp

      Filesize

      184KB

    • memory/2748-2-0x000007FEF5780000-0x000007FEF616C000-memory.dmp

      Filesize

      9.9MB

    • memory/2748-3-0x000007FEF5780000-0x000007FEF616C000-memory.dmp

      Filesize

      9.9MB