4b8a444481729c9ae07c826cda0e4a643a98d891d94ae8c7e30c3f428e105c84 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 16:10

Sharing

Report Analysis Logs

General

Target

blecher.exe
Size

2.6MB
MD5

4b269e4cf1ddf5392184f02216004c9f
SHA1

4caaa108ad4edeb5aef2f8e7c1e760852df1837f
SHA256

4b8a444481729c9ae07c826cda0e4a643a98d891d94ae8c7e30c3f428e105c84
SHA512

03dcc42566ca3e8a29baf46ed0ca424d190b6d0a27b423c59445682b4c50e1c9d86036ea13fb2c6fdb5ad54fe7bd8998842df85c0bca0444b6f5aac84b708920
SSDEEP

24576:PSqMZN8DPK8HqVh0lhSMXl7cMdfdV7dhXSKxNLE7uhjoRr:PS1Nn89TdFFdwy5

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2100	blecher.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 3056	2100	blecher.exe	30
PID 2100 wrote to memory of 3056	2100	blecher.exe	30
PID 2100 wrote to memory of 3056	2100	blecher.exe	30

C:\Users\Admin\AppData\Local\Temp\blecher.exe
"C:\Users\Admin\AppData\Local\Temp\blecher.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2100 -s 64
  2⤵
  PID:3056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads