422bfef6527ece23f30ead4917eb9a22f07486596c26026d964ebf78006e7b94 | Triage

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 20:14

Sharing

Report Analysis Logs

General

Target

sexcalibur.exe
Size

253KB
MD5

abbd30b394dffcfca74a349f583d1114
SHA1

c8d232cff79415514fd9fa55acffc634001d0268
SHA256

422bfef6527ece23f30ead4917eb9a22f07486596c26026d964ebf78006e7b94
SHA512

a302019c7e96563b03f46199d9d899f2ac8f10ed75fa6702eed071f22e023eede03557d608cc5d48bd87eab9e65e57f92588615436900c29bb685e221128fd9d
SSDEEP

6144:BQ/b/UMw4iZwT3w5h9JtM9KWeaimQuMhbcd/aJ:srU14iqjw5zM9F3i9uMAFaJ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 776 wrote to memory of 772	776	sexcalibur.exe	30
PID 776 wrote to memory of 772	776	sexcalibur.exe	30
PID 776 wrote to memory of 772	776	sexcalibur.exe	30

C:\Users\Admin\AppData\Local\Temp\sexcalibur.exe
"C:\Users\Admin\AppData\Local\Temp\sexcalibur.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:776
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 776 -s 56
  2⤵
  PID:772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads