4919a549a552e26a10c9cda5518928c373404b072690c338f5821c34218cf2bd | Triage

Resubmissions

17/11/2024, 05:10

241117-ft8j3swnck 10

Analysis

max time kernel
122s
max time network
135s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
17/11/2024, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Fluxus.exe
Size

314KB
MD5

39380751ccb5ba67afe489aa449f7095
SHA1

bbada4d300f774f66a9f3cea28bd6a51d80b503a
SHA256

c3443ddfba264e9becf7d41400c1c43bb15b3fdd91bb883bccc9a3a85f6dab92
SHA512

681e17cc42f3d75a23c7e85ad3d62c34c0cc114130fefc9747456fb75a3db0f0cd2520697f1fa6b3216d6880ff448abfca4feed8eeff07ed628e0fd2bf1b69f6
SSDEEP

3072:SdcElZm+a6dBTmseX27WQqmYwSKiIwOby6bdxmYwSKqIfV:QZmj6Basem7WZN8by6bdxN

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 524 wrote to memory of 2552	524	Fluxus.exe	31
PID 524 wrote to memory of 2552	524	Fluxus.exe	31
PID 524 wrote to memory of 2552	524	Fluxus.exe	31

C:\Users\Admin\AppData\Local\Temp\Fluxus.exe
"C:\Users\Admin\AppData\Local\Temp\Fluxus.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:524
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 524 -s 508
  2⤵
  PID:2552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/524-0-0x000007FEF58E3000-0x000007FEF58E4000-memory.dmp

Filesize
4KB

Download
memory/524-1-0x000000013FBC0000-0x000000013FC12000-memory.dmp

Filesize
328KB

Download