64b0f646baff4e69af64ca67c1e050a1d4a181106bfba1a5ff8e40acb50201f7 | Triage

Analysis

max time kernel
140s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 15:35

Sharing

Report Analysis Logs

General

Target

$TEMP/DVDTool.exe
Size

99KB
MD5

8dd598db59289736c42cf73afb27787c
SHA1

ec04d56c176c14b4d1201eea48805cea7f0764d4
SHA256

9abcdc8ad5d114723ac0c1816520c335955cb04d1fc36b03baa8f3784b3b4a41
SHA512

3b380fc858105df6d33b4c0fc4261b12aee7124fe15e3204db1f8ee56a5c6ce2dde38b485a02028da785cc101ed0c7ec1bcdd69485500cfeb4d24e465ac1b61f
SSDEEP

3072:ee55xzUF4oNzCogqxdwiacjy9nF5YKiUXRq7:r7xUFbWiyZ/h

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2748	600	WerFault.exe	29

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
600	DVDTool.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 600 wrote to memory of 2748	600	DVDTool.exe	30
PID 600 wrote to memory of 2748	600	DVDTool.exe	30
PID 600 wrote to memory of 2748	600	DVDTool.exe	30
PID 600 wrote to memory of 2748	600	DVDTool.exe	30

C:\Users\Admin\AppData\Local\Temp\$TEMP\DVDTool.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\DVDTool.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 600 -s 568
  2⤵
  - Program crash
  PID:2748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/600-0-0x00000000003A0000-0x00000000003BD000-memory.dmp

Filesize
116KB

Download
memory/600-1-0x00000000003A0000-0x00000000003BD000-memory.dmp

Filesize
116KB

Download
memory/600-2-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download