08e07a9533c746135608de187526fa018e931d22b1fc79f96422247fa30ff131 | Triage

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20-08-2024 01:48

Sharing

Report Analysis Logs

General

Target

GarticBot/ref/GarticBot.exe
Size

274KB
MD5

b3520be3d21a81c6b14457da67d36eb5
SHA1

8284e05ab0b6680045dba3bd9ec046ce707ce143
SHA256

7cf9ef7af38b54acdd250aae4f6579ee4f858b5d058399dbf80af3b8010666b5
SHA512

7bf8c189796e6805ccc5cc3861745f02bdd7a3d07918a0fba04cf9f4e85c1d77d364f329d12893552c3ce71deaf0cb34e6ca109243d4227e5ebd5850fb243826
SSDEEP

6144:iwVvu4sqWeQDkpAXtPlHLOL8CcJ20RmZQ33b:hV6qrQwpM9lHa4jwZQH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

GarticBot.exe

description	pid	process	target process
PID 2688 wrote to memory of 2796	2688	GarticBot.exe	WerFault.exe
PID 2688 wrote to memory of 2796	2688	GarticBot.exe	WerFault.exe
PID 2688 wrote to memory of 2796	2688	GarticBot.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\GarticBot\ref\GarticBot.exe
"C:\Users\Admin\AppData\Local\Temp\GarticBot\ref\GarticBot.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2688

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2688 -s 476
2⤵
PID:2796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2688-0-0x000007FEF5543000-0x000007FEF5544000-memory.dmp

Filesize
4KB

Download
memory/2688-1-0x000000013F5F0000-0x000000013F63A000-memory.dmp

Filesize
296KB

Download
memory/2688-2-0x000007FEF5543000-0x000007FEF5544000-memory.dmp

Filesize
4KB

Download