Analysis

  • max time kernel
    118s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    27-06-2024 15:23

General

  • Target

    [D]2024年移动合作方人员出入管理门禁安装程序.exe

  • Size

    1.2MB

  • MD5

    31d12c85fad4c87d200f24834dbdd54d

  • SHA1

    dff64c7fe5060c5beb8d3387f58daf2fcfef42a4

  • SHA256

    5bb87482aca08d98dd1391f7b0f1a394b6a2e42f3ecf212f002f62e2059bd0c5

  • SHA512

    b12ed5e81ce97f9efa3ef1381f892577422517a24724dc977d65e0cc72ee3e2b22dfee21f796c976eb1e5aa2b5b3bbfa017d2100e8787791dad27c6d7d71d374

  • SSDEEP

    12288:FICsXIYPcFFydh2ZkcnahSEiXhxGIknEJMq2BDaok1JyDx:2CsXxcih2znu0GIvJh1JyDx

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\[D]2024年移动合作方人员出入管理门禁安装程序.exe
    "C:\Users\Admin\AppData\Local\Temp\[D]2024年移动合作方人员出入管理门禁安装程序.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1208
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1208 -s 696
      2⤵
        PID:2684

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1208-0-0x000000013F5C0000-0x000000013F754000-memory.dmp

      Filesize

      1.6MB

    • memory/1208-1-0x0000000001BD0000-0x0000000001C32000-memory.dmp

      Filesize

      392KB