954c43ff928d85db80b063afe4d8840352404adbea17da49214be9040937d4fd | Triage

Analysis

max time kernel
2s
max time network
6s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/10/2024, 17:49

Sharing

Report Analysis Logs

General

Target

Setup.exe
Size

1.7MB
MD5

1c6d495f277e016142578900f89cad48
SHA1

a75520fa4588ba6d5a488f01838de8916c9c955e
SHA256

954c43ff928d85db80b063afe4d8840352404adbea17da49214be9040937d4fd
SHA512

617d9e0fde00b21a96765a47b35a5fa8226161f08ebdb74d76ec434ea3a61d6cf66aea22d3e96335199c2a2ea383df5c6a81f80a68fa7e8034cdb433d900816a
SSDEEP

49152:ibo95a6iGY06DoD/aM8tnQ2X2HcB5nrv:exM8bX28Bxr

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2788	2784	Setup.exe	30
PID 2784 wrote to memory of 2788	2784	Setup.exe	30
PID 2784 wrote to memory of 2788	2784	Setup.exe	30

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2784 -s 28
  2⤵
  PID:2788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2784-0-0x000000013F080000-0x000000013F235000-memory.dmp

Filesize
1.7MB

Download