8ddabb3123e9ce339e10e3a37e583be80b790b415bd81f28ec960e0741fb2784 | Triage

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13-09-2024 19:15

Sharing

Report Analysis Logs

General

Target

wentra/Spoofer.exe
Size

19KB
MD5

b14851dbf9c880fa7e82f473f039e27c
SHA1

6d75857683785ea7a521a276f208a2efd8ff8017
SHA256

592b6be347b53a82d76df7d97abf289ae5d5c816b863adb40aa9d6a5cbd63c61
SHA512

36a38bcebd99313a1a4fe7b766a5b5bb706c1bc7f80e938c8566fb399eabe186d0d556997af4744e4c2e3772e1de7fa209df26c35227c601f7ad9714b0b482f4
SSDEEP

384:RAZiqa8rhY8Jf9l2Dv9xAzbkKf+iFD7ePUkLPyPfkl+vzwjKqPeW:Ruiqaf8t9oubnPgUmwRW

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2884	2756	Spoofer.exe	30
PID 2756 wrote to memory of 2884	2756	Spoofer.exe	30
PID 2756 wrote to memory of 2884	2756	Spoofer.exe	30

C:\Users\Admin\AppData\Local\Temp\wentra\Spoofer.exe
"C:\Users\Admin\AppData\Local\Temp\wentra\Spoofer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2756 -s 504
  2⤵
  PID:2884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2756-0-0x000007FEF5B43000-0x000007FEF5B44000-memory.dmp

Filesize
4KB

Download
memory/2756-1-0x0000000000880000-0x000000000088C000-memory.dmp

Filesize
48KB

Download
memory/2756-2-0x000007FEF5B43000-0x000007FEF5B44000-memory.dmp

Filesize
4KB

Download