fb9c25da973a81fbbaca16011aba651bf9b5e1d98f1f1a5a500ab00c781ebcb8 | Triage

Resubmissions

29/06/2024, 20:48

240629-zlmr7awbre 8

29/06/2024, 20:47

240629-zlcbfswbra 8

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/06/2024, 20:48

Sharing

Report Analysis Logs

General

Target

agent.exe
Size

113KB
MD5

f5f8160fe8468a77b6a495155c3dacea
SHA1

20d61c337653392ea472352931820dc60c37b2bc
SHA256

44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2
SHA512

c65b86d579f7c0defba655ce440a20f1bb5447e058861540e92d80968131d40cc9fa42defb2c613d92de323f42301f59eacc6cfce5f34ca2c2170f0692919db8
SSDEEP

3072:VKMMWFhWGRGhZIzPic5RbQ9b4R1DcMxaiJe:AMZh1kUPiMMKR1DTJ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 1400	1316	agent.exe	29
PID 1316 wrote to memory of 1400	1316	agent.exe	29
PID 1316 wrote to memory of 1400	1316	agent.exe	29

C:\Users\Admin\AppData\Local\Temp\agent.exe
"C:\Users\Admin\AppData\Local\Temp\agent.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1316 -s 36
  2⤵
  PID:1400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads