baff3039b9acf97084d1b853f495026c52a4c483d010901e226beb599d23df5b | Triage

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26-06-2024 20:01

Sharing

Report Analysis Logs

General

Target

rise2606.exe
Size

1.8MB
MD5

c72e70f29d3dd8fa148df55e8e6dec43
SHA1

2f182d43528f78d6d847b37b77da9a09a2ed1f0a
SHA256

baff3039b9acf97084d1b853f495026c52a4c483d010901e226beb599d23df5b
SHA512

d1923e33057413d478daaaaa54bb157762172a58ae03fc36e0c1c6e4d64c0c33d08bff7aec8759f533331215960d739fec2ffea86d18d1d8a70105927a6a5f12
SSDEEP

49152:XZKDuL48I2oJDxrV/4ePVhfBHcXuCEe/vPOM6yWKp3+EmfOS:XZ2uL439144fCXubCv2M6yWy3+i

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2240	492	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 492 wrote to memory of 2240	492	rise2606.exe	29
PID 492 wrote to memory of 2240	492	rise2606.exe	29
PID 492 wrote to memory of 2240	492	rise2606.exe	29
PID 492 wrote to memory of 2240	492	rise2606.exe	29

C:\Users\Admin\AppData\Local\Temp\rise2606.exe
"C:\Users\Admin\AppData\Local\Temp\rise2606.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 492 -s 108
  2⤵
  - Program crash
  PID:2240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/492-0-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download