eb79368e3d08078cd2c59c4e4ad38ead9d44a79253cba084ab8013be126abf03 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-12-2024 22:23

Sharing

Report Analysis Logs

General

Target

RoyalKing Bootstraper.exe
Size

39KB
MD5

8c723a3169b077a877802649d7f8ad74
SHA1

16650c695bc5966c50229c976916464e36d083bc
SHA256

f9718b38ff60d7521a28816a474e2851537c67576c7c6c7b1c18f8ba3f84375b
SHA512

aaae12062e64f6f4c503d73912bc249e08d20b0caa1fca51236e46818edcd1b9a56467b02ef15376baeaac3dbf8c9d01637498284d144d73d60808b12dae7e9c
SSDEEP

768:cmQZqx1lYcJHNP1divdCxuoLZb69UJpJXbOfq1Ykjhm:c0lYXvIxJLZb6QzbO+jhm

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 316	2900	RoyalKing Bootstraper.exe	28
PID 2900 wrote to memory of 316	2900	RoyalKing Bootstraper.exe	28
PID 2900 wrote to memory of 316	2900	RoyalKing Bootstraper.exe	28

C:\Users\Admin\AppData\Local\Temp\RoyalKing Bootstraper.exe
"C:\Users\Admin\AppData\Local\Temp\RoyalKing Bootstraper.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2900 -s 528
  2⤵
  PID:316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2900-0-0x000007FEF5583000-0x000007FEF5584000-memory.dmp

Filesize
4KB

Download
memory/2900-1-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download