5c3be59f85aa33ee9702c04132f7ec86317fdfecac4ca9d5f3f41d265037e164 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-10-2024 15:49

Sharing

Report Analysis Logs

General

Target

DLL Payloads/UevAppMonitor.exe
Size

54KB
MD5

c4452ca851d9067655a1140371dc7552
SHA1

810e73381c4453c465695f15e19d0a6011cce73f
SHA256

5174a1adf2c7ebab1b76fd6fb23ff437aba0150bd994990ed56b093e96c1f48d
SHA512

f1e69dbd2167e21ef9acd9f51aedc468a82c213b45c84a3f8c07dbd9c19f6a11dcfbb77bb127c25cdd18f7858c86ed84070cfdfe3fd3604d9fe361b98e2e8ab7
SSDEEP

768:UQdiFsQ+wzon91slxN+u996swwiKEtycTY5lkQ7Vy9ylDXI:0lQ91szN++6NwiKE10Djlc

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

UevAppMonitor.exe

description	pid	Process	procid_target
PID 1600 wrote to memory of 2716	1600	UevAppMonitor.exe	30
PID 1600 wrote to memory of 2716	1600	UevAppMonitor.exe	30
PID 1600 wrote to memory of 2716	1600	UevAppMonitor.exe	30

C:\Users\Admin\AppData\Local\Temp\DLL Payloads\UevAppMonitor.exe
"C:\Users\Admin\AppData\Local\Temp\DLL Payloads\UevAppMonitor.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1600 -s 520
  2⤵
  PID:2716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1600-0-0x000007FEF4E33000-0x000007FEF4E34000-memory.dmp

Filesize
4KB

Download