c11ca83b933ebaaa1635f60bae375034fd418fe8562e4f4eeb8884f7560e7f2a | Triage

Analysis

max time kernel
14s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 22:13

Sharing

Report Analysis Logs

General

Target

Apocalypse.exe
Size

877KB
MD5

96944df5968e077353689fab7f453070
SHA1

0a6485e60deece98dd3f61fe4498268d11573e34
SHA256

c11ca83b933ebaaa1635f60bae375034fd418fe8562e4f4eeb8884f7560e7f2a
SHA512

90ffc06b942f8742410ace38ecb9cd534ff0bd15f4fdb7588e23994c35851e77753fae19d1a055306d807947c11891094c2bb8f4ba23a804956a199d35f012b9
SSDEEP

24576:lKUPAYQ2rfeSM+ToLImRZk+Uxz7xhfssz8G0/G:UUPAYQom/WoLImzwz7ssgBG

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1560	2064	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 1560	2064	Apocalypse.exe	29
PID 2064 wrote to memory of 1560	2064	Apocalypse.exe	29
PID 2064 wrote to memory of 1560	2064	Apocalypse.exe	29
PID 2064 wrote to memory of 1560	2064	Apocalypse.exe	29

C:\Users\Admin\AppData\Local\Temp\Apocalypse.exe
"C:\Users\Admin\AppData\Local\Temp\Apocalypse.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 112
  2⤵
  - Program crash
  PID:1560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2064-0-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download