38f09edc87d2d94f3e8fe2e6119be2285e2e0afd64d0c4a53f7d62c9d8f9cbf3 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
06-10-2024 11:04

Sharing

Report Analysis Logs

General

Target

setup.7.0.exe
Size

1.7MB
MD5

994bb906f5c652d50b21a45c76c530c1
SHA1

ad90263d8b82f065a56efc728f6e226a60196792
SHA256

1a471d692acc84510b6af7c3ca4953823177bd4af8b569480a7e0862f88587e0
SHA512

6a99872d9884a1d609f984038fb661ac4e44608591d14cdb76741ecbb9bd5bfb6d1edb9f07c45865837502bc6b5dee74947179dd1eb38a4d7c1f7b2a30ca139c
SSDEEP

49152:7bo95a6iGYm/aY3NZd7LcwSrhn8SjWoCu:w/n7LyhZjWoCu

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2356	2320	setup.7.0.exe	30
PID 2320 wrote to memory of 2356	2320	setup.7.0.exe	30
PID 2320 wrote to memory of 2356	2320	setup.7.0.exe	30

C:\Users\Admin\AppData\Local\Temp\setup.7.0.exe
"C:\Users\Admin\AppData\Local\Temp\setup.7.0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2320 -s 28
  2⤵
  PID:2356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2320-0-0x000000013F6E0000-0x000000013F895000-memory.dmp

Filesize
1.7MB

Download