753e172b18477c378a8791e7b46065e30db9e7a81ad816a0a99ff143427c5c45 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 09:36

Sharing

Report Analysis Logs

General

Target

Freakysploit.exe
Size

198KB
MD5

0ec066af3d0a6bc37211953502c4f10e
SHA1

ad5fc666110fb4bc409325df3243e37968bc7cca
SHA256

753e172b18477c378a8791e7b46065e30db9e7a81ad816a0a99ff143427c5c45
SHA512

d871608ced02dc228719291a8bf00f20b92eae2fc3df164e2c40838471c0c699564fe2027226a699ff144f97e96b7c7bf0dcaecd9684125f39cf7840a9dc5245
SSDEEP

3072:cIDjz7MnJ8JGR98deL8nOhJng/33N2QdtLaPU:77MnJ8JGR98deL8nOhJngv3N2Q

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1320	2240	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 1320	2240	Freakysploit.exe	28
PID 2240 wrote to memory of 1320	2240	Freakysploit.exe	28
PID 2240 wrote to memory of 1320	2240	Freakysploit.exe	28
PID 2240 wrote to memory of 1320	2240	Freakysploit.exe	28

C:\Users\Admin\AppData\Local\Temp\Freakysploit.exe
"C:\Users\Admin\AppData\Local\Temp\Freakysploit.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 552
  2⤵
  - Program crash
  PID:1320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2240-0-0x0000000074D8E000-0x0000000074D8F000-memory.dmp

Filesize
4KB

Download
memory/2240-1-0x0000000000F00000-0x0000000000F38000-memory.dmp

Filesize
224KB

Download
memory/2240-2-0x0000000074D8E000-0x0000000074D8F000-memory.dmp

Filesize
4KB

Download