f585f729ebcdaf7a70e16690398cca0036d1dd4c398b4044004e7ab0ccc6bf56 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-10-2024 20:18

Sharing

Report Analysis Logs

General

Target

setup7.0.exe
Size

1.7MB
MD5

2c685fc5572fee6107d76c17fa873a45
SHA1

05436164ce59ab80e0bcae7aa779b2426866446e
SHA256

f585f729ebcdaf7a70e16690398cca0036d1dd4c398b4044004e7ab0ccc6bf56
SHA512

6bd9fbf04c75c0a6a07846233e5cb31f7f8373f3bd2fc62f70f27c34d37d640d80647ca980530ba99d77586a954c73899a257e1dc2e422279a0c46f69e2107e3
SSDEEP

49152:Fbo95a6iGYqDAtQRcsZT6jgLUcSEubOJE5eo55iRQ6Uoy:SDAtQ+sZ2jgQc7Cwk55i3

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 2972	1624	setup7.0.exe	31
PID 1624 wrote to memory of 2972	1624	setup7.0.exe	31
PID 1624 wrote to memory of 2972	1624	setup7.0.exe	31

C:\Users\Admin\AppData\Local\Temp\setup7.0.exe
"C:\Users\Admin\AppData\Local\Temp\setup7.0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1624 -s 28
  2⤵
  PID:2972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1624-0-0x000000013F360000-0x000000013F515000-memory.dmp

Filesize
1.7MB

Download