Analysis
-
max time kernel
13s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
21/10/2024, 08:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
HeartBreakerContinuum/Superstar_MemberCard.tiff.exe
Resource
win7-20241010-en
1 signatures
150 seconds
General
-
Target
HeartBreakerContinuum/Superstar_MemberCard.tiff.exe
-
Size
40KB
-
MD5
ace3e42d95e5b9d0744763bde9888069
-
SHA1
6236f6f30e1cd180d3f9bd1d48ea4cccdfc2a806
-
SHA256
12daa34111bb54b3dcbad42305663e44e7e6c3842f015cccbbe6564d9dfd3ea3
-
SHA512
5c17eb87d60794be010e50c8cb62dc72bcfcfae15c5b79d39f1fca769acf82dce8eafe807a9a9bf00c9ecdbd5d7383fca7fa344e76373e22bd6de545501e68e2
-
SSDEEP
768:ZCIFqGveQJUJtVeD3sl/Qq9QSucEQ0xIlBcVpXbOfq19kQa1:ZC4qGveQJ93sl/Qq9QSucEQ0xIlBubOV
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2524 wrote to memory of 2568 2524 Superstar_MemberCard.tiff.exe 30 PID 2524 wrote to memory of 2568 2524 Superstar_MemberCard.tiff.exe 30 PID 2524 wrote to memory of 2568 2524 Superstar_MemberCard.tiff.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\HeartBreakerContinuum\Superstar_MemberCard.tiff.exe"C:\Users\Admin\AppData\Local\Temp\HeartBreakerContinuum\Superstar_MemberCard.tiff.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2524 -s 5322⤵PID:2568
-