6e14431a73b8f0b084d1a1eb9d9251cb643804ff8895f89df094e9a9bf7b7051 | Triage

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15/09/2024, 07:19 UTC

Sharing

Report Analysis Logs

General

Target

bakinplayer.exe
Size

575KB
MD5

7a4d0364396c282dc80edcd4e2038f9f
SHA1

1b38d008a71ed69f63efe8a6ac50866df8c654ba
SHA256

6e14431a73b8f0b084d1a1eb9d9251cb643804ff8895f89df094e9a9bf7b7051
SHA512

382f5b798b4ab1cd924d08d2a4f59bbe65a3e367a63d7152b3c4d3a10429919fe8a0a7f13771703a1e730b8be149a5070409ae90b2acd7b757720d1bcc7e1621
SSDEEP

6144:owMvFqgcBlWS9EqQGWESWDIWgfWJRwjgJTk939M46PdP:sv0Aj6Px

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 2504	884	bakinplayer.exe	30
PID 884 wrote to memory of 2504	884	bakinplayer.exe	30
PID 884 wrote to memory of 2504	884	bakinplayer.exe	30

C:\Users\Admin\AppData\Local\Temp\bakinplayer.exe
"C:\Users\Admin\AppData\Local\Temp\bakinplayer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:884
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 884 -s 540
  2⤵
  PID:2504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/884-0-0x000007FEF4E23000-0x000007FEF4E24000-memory.dmp

Filesize
4KB

Download
memory/884-1-0x000000013F740000-0x000000013F7D4000-memory.dmp

Filesize
592KB

Download