b8beb5e27fc339772b63ed454ec054a16b554e5c354eab8de7b4addbe238f403 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 01:42

Sharing

Report Analysis Logs

General

Target

op/Pro-CLA.exe
Size

8KB
MD5

79ed88fa92f87bf8f36ed98c44436472
SHA1

4a3d67a2fcfcf744699eef9932162b32dc1dcad0
SHA256

94cd0c50f1cd9cd0e5e137e765dc8306793624a94584415ad71473eeed98401f
SHA512

e5ea8bfcd591e879ef6d38a809bb03b936f3b4f0dfee5890d75d04b360af2931e465031f303120752df540ea667224397f0d704a4f49f3ead194b2f9dffb49b2
SSDEEP

192:UHg9gKm+3vOFBN/k6Kl170hwwMaf2Smo7eSbu:UACQeBN+r0BMa9N7f

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2792	2212	Pro-CLA.exe	30
PID 2212 wrote to memory of 2792	2212	Pro-CLA.exe	30
PID 2212 wrote to memory of 2792	2212	Pro-CLA.exe	30

C:\Users\Admin\AppData\Local\Temp\op\Pro-CLA.exe
"C:\Users\Admin\AppData\Local\Temp\op\Pro-CLA.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2212 -s 504
  2⤵
  PID:2792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2212-0-0x000007FEF62E3000-0x000007FEF62E4000-memory.dmp

Filesize
4KB

Download
memory/2212-1-0x0000000001320000-0x0000000001328000-memory.dmp

Filesize
32KB

Download