ca7a8be040371db76cadba7e926c9d98ab61a8b8e7e6d39f6e015fca6cb5bab4 | Triage

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05-07-2024 04:47

Sharing

Report Analysis Logs

General

Target

dstream.log.exe
Size

4.9MB
MD5

fb1d8d0ba73b7d30b38057853705b160
SHA1

5b36e28d52a1ac061a0653d23baf5277cb543568
SHA256

ca7a8be040371db76cadba7e926c9d98ab61a8b8e7e6d39f6e015fca6cb5bab4
SHA512

4b1937788cd7d7d328a529f693f1eb9247eeab122729343e9a076f552d8a7ef0d0fa5f1fdf78747f4b2c071b61b5ab644bf2733076fe2c62031a7f47f4622ed2
SSDEEP

98304:25LWJ3+vTtkBZQnyFNT3FPfJ6DFkhyzQjh5/5IAOP/Q:25LWVCnoZ38DzQ15/5IVXQ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 1936	1628	dstream.log.exe	28
PID 1628 wrote to memory of 1936	1628	dstream.log.exe	28
PID 1628 wrote to memory of 1936	1628	dstream.log.exe	28

C:\Users\Admin\AppData\Local\Temp\dstream.log.exe
"C:\Users\Admin\AppData\Local\Temp\dstream.log.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1628 -s 92
  2⤵
  PID:1936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads