9c722efda237af4e856b06657c20ad677d6c75ea33a033e28fa3f522039b5eae | Triage

Analysis

max time kernel
14s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 14:34

Sharing

Report Analysis Logs

General

Target

SheetRat/Stub/Client.exe
Size

47KB
MD5

a0e04bf9b43f0b442bd3193f06dc52b5
SHA1

30bb0c17640c414d948ed3e2fdf571b98f125efb
SHA256

71824238c3baec179911bd6e4655ebff234e15d0f14248077e2c388ef4337009
SHA512

d7015f5c8223ba0f4e3b478185fa3e4de0831aee949302185fdc8b3afe59105fe096a3e5ee23219a1c16dfcbc77d169a82774ecd727ef98bdb94a878583a2ae2
SSDEEP

768:+nqRz+Q9CF6abcLPbUG9bOplP7ZXdEEyb:B9g6asD79bOHLDu

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 2664	1592	Client.exe	30
PID 1592 wrote to memory of 2664	1592	Client.exe	30
PID 1592 wrote to memory of 2664	1592	Client.exe	30

C:\Users\Admin\AppData\Local\Temp\SheetRat\Stub\Client.exe
"C:\Users\Admin\AppData\Local\Temp\SheetRat\Stub\Client.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1592 -s 520
  2⤵
  PID:2664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1592-0-0x000007FEF5BE3000-0x000007FEF5BE4000-memory.dmp

Filesize
4KB

Download
memory/1592-1-0x0000000001150000-0x0000000001162000-memory.dmp

Filesize
72KB

Download