b1a638cc1c6fab24c26193035daa72cdc459deebf7a11de130cf41a4218e81d0 | Triage

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 16:23

Sharing

Report Analysis Logs

General

Target

setup_run.exe
Size

1.7MB
MD5

f9e546bb5a4898d65b61f8b3d93a1662
SHA1

a4f5d8c4fec7657211c71c31f92d347cad13b1c8
SHA256

b1a638cc1c6fab24c26193035daa72cdc459deebf7a11de130cf41a4218e81d0
SHA512

a98fdb03a485051f33ea092b0805d2c2f3e2d3a3a58697a120459139ab2b6c94c27910467cc863ad78defcbf7d90f2edd81fb2356daa9f76bb448e9cf609e037
SSDEEP

49152:ubo95a6iGYtRzPWn9jbijSv3ZXYUYpyc2y5BkA:eBP0OSvZXwpcy5Bk

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2788	2792	setup_run.exe	30
PID 2792 wrote to memory of 2788	2792	setup_run.exe	30
PID 2792 wrote to memory of 2788	2792	setup_run.exe	30

C:\Users\Admin\AppData\Local\Temp\setup_run.exe
"C:\Users\Admin\AppData\Local\Temp\setup_run.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2792 -s 28
  2⤵
  PID:2788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2792-0-0x000000013FEF0000-0x00000001400A5000-memory.dmp

Filesize
1.7MB

Download