d4979877d317ac3ee167239f647f6a55a821cfac7875528e3bbecb7110f2f60b | Triage

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 09:57

Sharing

Report Analysis Logs

General

Target

uninst.exe
Size

150KB
MD5

9b85c3ff3184aa53f4f28b8c6253babf
SHA1

ab23d393eb0c0b622bc7b6ea62f31c2c5d7fecb2
SHA256

b29fad48875e434911692a13881cc49c2349b9ed402316da67cc5da3daea191f
SHA512

fb6629c3cfb892d8bdfa6e3d1061ec8926c6d09f23d26033afa95b8ebc7284c52fcb9f481945431bb76bef411364c63f84c77068b5717506e6dd22ccbc270b68
SSDEEP

3072:1aF6FILxuJ8JutbHewZuOf/iYxnlJQGpwsIdQS:+O9jt6wZug3puGS

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1696	2340	WerFault.exe	30

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 1696	2340	uninst.exe	31
PID 2340 wrote to memory of 1696	2340	uninst.exe	31
PID 2340 wrote to memory of 1696	2340	uninst.exe	31
PID 2340 wrote to memory of 1696	2340	uninst.exe	31
PID 2340 wrote to memory of 1696	2340	uninst.exe	31
PID 2340 wrote to memory of 1696	2340	uninst.exe	31
PID 2340 wrote to memory of 1696	2340	uninst.exe	31

C:\Users\Admin\AppData\Local\Temp\uninst.exe
"C:\Users\Admin\AppData\Local\Temp\uninst.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 264
  2⤵
  - Program crash
  PID:1696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2340-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2340-1-0x00000000003B0000-0x00000000003F3000-memory.dmp

Filesize
268KB

Download