c8e26282d16d383a962f67616a11a1338377b4f1668c57e2e652b447916ab66b | Triage

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 23:59

Sharing

Report Analysis Logs

General

Target

$TEMP/matrix33680.exe
Size

64KB
MD5

677dd6a715290bfa453cda92e6e00da4
SHA1

540f607d63f8715feaf53bca2ae96f727a9b7299
SHA256

81f17cc0d8b8c45468d024fcadca3242b1844989086103e7b5800c7a49861f63
SHA512

89839fc24b284ebfb4b840d6516c924726f586ac20314e9a8a0d1bffe66a61afdb41afba2a6baaffd27251c94f7facb817bf9a972c43517d0192a1685db6b094
SSDEEP

1536:aK35SBKH0CsPowaIHtrnCAMVN+8ve3tiJyK7A/i:aK3M8HwtjfMeIJyqA/

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2836	2976	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2836	2976	matrix33680.exe	28
PID 2976 wrote to memory of 2836	2976	matrix33680.exe	28
PID 2976 wrote to memory of 2836	2976	matrix33680.exe	28
PID 2976 wrote to memory of 2836	2976	matrix33680.exe	28

C:\Users\Admin\AppData\Local\Temp\$TEMP\matrix33680.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\matrix33680.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 36
  2⤵
  - Program crash
  PID:2836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2976-0-0x000000000040A000-0x0000000000415000-memory.dmp

Filesize
44KB

Download
memory/2976-1-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download