8a33cc7af2cf926411f45236cb841d1b5ab667aabff7c85c102a0edb2baa2534 | Triage

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
07-07-2024 03:18

Sharing

Report Analysis Logs

General

Target

ref/Ruler.IRule.exe
Size

19KB
MD5

53219a941c35e570766d68b006e564da
SHA1

3e30428a2b0b355244250707222d0fe3e1120de5
SHA256

d71d16e27a2588d571b9fb5d363d8d0fc21cdb9c7147cd62a1fa3d2965d7d3ca
SHA512

f6f892bf6dca0c0170151331d02c7593c51cbf2a2b1263f590820ad01622aa289c03b9c9c837c3a429cb9d5099d7807e9ade80037b285549a1d15ce171754ff4
SSDEEP

192:goJtxMHb92e7PSjNtB2vwAbKBrJFEgG81V:g0xM7QOsNtCKBf

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Ruler.IRule.exe

description	pid	process	target process
PID 2560 wrote to memory of 2160	2560	Ruler.IRule.exe	WerFault.exe
PID 2560 wrote to memory of 2160	2560	Ruler.IRule.exe	WerFault.exe
PID 2560 wrote to memory of 2160	2560	Ruler.IRule.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ref\Ruler.IRule.exe
"C:\Users\Admin\AppData\Local\Temp\ref\Ruler.IRule.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2560

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2560 -s 484
2⤵
PID:2160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2560-0-0x000007FEF5FF3000-0x000007FEF5FF4000-memory.dmp

Filesize
4KB

Download
memory/2560-1-0x0000000000390000-0x000000000039C000-memory.dmp

Filesize
48KB

Download
memory/2560-2-0x000007FEF5FF3000-0x000007FEF5FF4000-memory.dmp

Filesize
4KB

Download