6cbdc7b32de7ad74f26b260a0e9c6477ac630bc4e535c7d57f5adb6147f4fc16 | Triage

Analysis

max time kernel
5s
max time network
0s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-06-2024 06:02

Sharing

Report Analysis Logs

General

Target

TDLoader.exe
Size

903KB
MD5

735843a88c00cb5d1e543b8b415fedae
SHA1

b2a2ffeacc84ad561aeb6211cae8310e9b080fa4
SHA256

6cbdc7b32de7ad74f26b260a0e9c6477ac630bc4e535c7d57f5adb6147f4fc16
SHA512

c09f7e4cbee58253f884dbbbd731616de4b1452d47f4fcae549697d1a189a6e57b03d44d718b80f4c0abf059f8027dc518dee40fc2d9e070bc762a9ce7dc3a79
SSDEEP

12288:RpzYjf6ne5t4vVc5mbljYDuRm/e5t4vVc5mbljYDuRmg5t4vVc5mbljYDuRmb:DnbAmmCsbAmmCKAmmCG

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
764	2156	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 764	2156	TDLoader.exe	28
PID 2156 wrote to memory of 764	2156	TDLoader.exe	28
PID 2156 wrote to memory of 764	2156	TDLoader.exe	28
PID 2156 wrote to memory of 764	2156	TDLoader.exe	28

C:\Users\Admin\AppData\Local\Temp\TDLoader.exe
"C:\Users\Admin\AppData\Local\Temp\TDLoader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 632
  2⤵
  - Program crash
  PID:764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2156-0-0x00000000748CE000-0x00000000748CF000-memory.dmp

Filesize
4KB

Download
memory/2156-1-0x0000000000230000-0x0000000000316000-memory.dmp

Filesize
920KB

Download
memory/2156-2-0x00000000748C0000-0x0000000074FAE000-memory.dmp

Filesize
6.9MB

Download
memory/2156-3-0x00000000748C0000-0x0000000074FAE000-memory.dmp

Filesize
6.9MB

Download