cb8b98537cfd5101d1ff182c696cb16fc6478822f6c7deced4efc08b6b02114a | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 16:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

github.software.1.2.4.exe
Size

512KB
MD5

40e2eec44440b05252d597d1f3a7c322
SHA1

9a5ee75fdba536d3e954e70c58597e96a6921658
SHA256

cb8b98537cfd5101d1ff182c696cb16fc6478822f6c7deced4efc08b6b02114a
SHA512

325c54743904c7f183d46b7fd16686f0594bd41f85954b8237fcd455542b981804accc65decc4535b0b4122d6be8c41d2470b9f0bc991bf8a4beda14800506d3
SSDEEP

12288:YBzlsxxxMCQMQA1cR0HB7Ndtjpw2zw1ybLnOMA:Y5iDxWIciHB7jxzw1ybLn

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2980	1768	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 2980	1768	github.software.1.2.4.exe	29
PID 1768 wrote to memory of 2980	1768	github.software.1.2.4.exe	29
PID 1768 wrote to memory of 2980	1768	github.software.1.2.4.exe	29
PID 1768 wrote to memory of 2980	1768	github.software.1.2.4.exe	29

C:\Users\Admin\AppData\Local\Temp\github.software.1.2.4.exe
"C:\Users\Admin\AppData\Local\Temp\github.software.1.2.4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 96
  2⤵
  - Program crash
  PID:2980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1768-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download