8763547429c3c40bcbe41bb29cdb19812068ac7cd0f7cc325394e3123da7b825 | Triage

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 23:37

Sharing

Report Analysis Logs

General

Target

oMrongStealer.vshost.exe
Size

22KB
MD5

00c54466cfc232e2ba1dfc4f3a679f05
SHA1

59bedfb34a5e6dc19724bab57aa72a2ddd9f76b0
SHA256

099923b629ff4309a579a66eaa857de4e5d5caa093b6226ee7c491742d9168e9
SHA512

a82bff5bd94a26fcb11d50213ff85076b3856b3f16259f8ff7ec6842b933d25e369f50c978ec9c5be589683dcdd1d5f7d5c7d093d71e737cc3f60a43f7b49416
SSDEEP

384:JC3PZcWoWWnb/B0GftpBjPTl0qH3HRN7mF+lCY9uSX:I/U+iRB0qHuq3

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2388	1968	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2388	1968	oMrongStealer.vshost.exe	30
PID 1968 wrote to memory of 2388	1968	oMrongStealer.vshost.exe	30
PID 1968 wrote to memory of 2388	1968	oMrongStealer.vshost.exe	30
PID 1968 wrote to memory of 2388	1968	oMrongStealer.vshost.exe	30

C:\Users\Admin\AppData\Local\Temp\oMrongStealer.vshost.exe
"C:\Users\Admin\AppData\Local\Temp\oMrongStealer.vshost.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 532
  2⤵
  - Program crash
  PID:2388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1968-0-0x0000000073F9E000-0x0000000073F9F000-memory.dmp

Filesize
4KB

Download
memory/1968-1-0x0000000000B80000-0x0000000000B88000-memory.dmp

Filesize
32KB

Download
memory/1968-2-0x0000000073F9E000-0x0000000073F9F000-memory.dmp

Filesize
4KB

Download