f6001c8b8d9084654ef5f429e672257b690d651f96e3c493e2f65457b8eabea1 | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 23:23

Sharing

Report Analysis Logs

General

Target

GoKuaiUpdate.exe
Size

210KB
MD5

1ef0e1153bcd55b6f56891f94066d225
SHA1

cd863f87a7a87a162087bc26f481d66122394a24
SHA256

a79104c556c0fbe425bae24c3bd8bb56c25a902a219e79fea9e28f4e695e6688
SHA512

2847869d1186da05eef1f9b498478d1ee70cfcf2e1f215f123b12a76bd9d70f065cadf562d6ce9f90099cdfe8360591c4130f8885bbf00ab7a742980a1c16a78
SSDEEP

6144:dYGVOqttWxh2duVoaPZCPZztWx1/KuaVoL:dY49diGzsD

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
2780	2340	WerFault.exe	27

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

GoKuaiUpdate.exe

pid	Process
2340	GoKuaiUpdate.exe
2340	GoKuaiUpdate.exe
2340	GoKuaiUpdate.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

GoKuaiUpdate.exe

description	pid	Process	procid_target
PID 2340 wrote to memory of 2780	2340	GoKuaiUpdate.exe	29
PID 2340 wrote to memory of 2780	2340	GoKuaiUpdate.exe	29
PID 2340 wrote to memory of 2780	2340	GoKuaiUpdate.exe	29
PID 2340 wrote to memory of 2780	2340	GoKuaiUpdate.exe	29

C:\Users\Admin\AppData\Local\Temp\GoKuaiUpdate.exe
"C:\Users\Admin\AppData\Local\Temp\GoKuaiUpdate.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 812
  2⤵
  - Program crash
  PID:2780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads