62aa2afbf0b5c5866f570375612d68991052addb6326b0b390ad25fa134b9d9b | Triage

Resubmissions

10/07/2024, 01:59

240710-cevsws1hqe 3

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 01:59

Sharing

Report Analysis Logs

General

Target

Crystal.exe
Size

496KB
MD5

4c54b8b2876ebff55f5738588c0141cd
SHA1

c540fefcb75d161a7318c051dc5d6a755b373218
SHA256

62aa2afbf0b5c5866f570375612d68991052addb6326b0b390ad25fa134b9d9b
SHA512

37c63c84ab2369fa311a45319dea9cc691d122ce383a8c50ae017dab179f37e442351437fbbf0e6201b6673f3c248cb5912c66e05cbfe8db0d74a115b2e24e81
SSDEEP

12288:UpaBBJDKcnibEXTecBlgsVdZHZUEC5XS/ADaMjB:MaBB0cqaTrBas/BZOlDR

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3020	2460	WerFault.exe	30

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 3020	2460	Crystal.exe	31
PID 2460 wrote to memory of 3020	2460	Crystal.exe	31
PID 2460 wrote to memory of 3020	2460	Crystal.exe	31
PID 2460 wrote to memory of 3020	2460	Crystal.exe	31

C:\Users\Admin\AppData\Local\Temp\Crystal.exe
"C:\Users\Admin\AppData\Local\Temp\Crystal.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 656
  2⤵
  - Program crash
  PID:3020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2460-0-0x00000000744FE000-0x00000000744FF000-memory.dmp

Filesize
4KB

Download
memory/2460-1-0x0000000001310000-0x0000000001392000-memory.dmp

Filesize
520KB

Download
memory/2460-2-0x00000000744F0000-0x0000000074BDE000-memory.dmp

Filesize
6.9MB

Download
memory/2460-3-0x00000000744F0000-0x0000000074BDE000-memory.dmp

Filesize
6.9MB

Download