936db64a9044bbaefe18d5e03281ebe45064539d4511e57cfea0ae64aa087377 | Triage

Analysis

max time kernel
7s
max time network
1s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 16:11

Sharing

Report Analysis Logs

General

Target

AnyDesk.exe
Size

10.0MB
MD5

5bd41fb32a3431b5a9f368aea302a6da
SHA1

79a6a63185607a5ac18cb62e9bb750ca73f6576d
SHA256

936db64a9044bbaefe18d5e03281ebe45064539d4511e57cfea0ae64aa087377
SHA512

807dab802e87fd0c63c7f68552ffb23d2c2eb279648dfc6393d79cda5e515be0f5a3313ae8c53f14c1fff3fe9068f7749488aa33fd149f51b135684eb07d1ae7
SSDEEP

196608:sZC1F51m8yWTFJK/bnhTV2Dv2nQlq8ZbeiVXreEO74LQQ6n:bFjhK/bnhTVC7nSUKEAeQQk

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2284	2460	AnyDesk.exe	30
PID 2460 wrote to memory of 2284	2460	AnyDesk.exe	30
PID 2460 wrote to memory of 2284	2460	AnyDesk.exe	30

C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2460 -s 112
  2⤵
  PID:2284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2460-0-0x0000000140000000-0x0000000140F29000-memory.dmp

Filesize
15.2MB

Download