e6f2909897bb3c7d4d69f537f3cb3b6b0f11d813fca3c553d131d991de80c962 | Triage

Resubmissions

30/12/2024, 17:03

241230-vks6cssqav 10

30/12/2024, 17:02

241230-vj8veszpgr 10

Analysis

max time kernel
15s
max time network
17s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
30/12/2024, 17:03

Sharing

Report Analysis Logs

General

Target

Collapse.exe
Size

3.1MB
MD5

09776d1e6b458622944c21a37127d945
SHA1

55fe43db0038a411d1302b85cb1d8c61704bf2a4
SHA256

6718e20d2fcaed405be6cb6784e6df72d93e5449fbab18e4d2d1dec5e2efde0a
SHA512

e530a84c2bf855f8ed7ec667f12dd738c0af4a6f63efb861432065634d4d5afb5e8369d28e1c90753efe5ed24bbf384ac5e20819efdc3b73735a31fce7e83d07
SSDEEP

49152:SZQQYNwNfHO8dkHOL+/4n5TlqmjPEY5XlPHXc1jbIEXVQ7IiVVNSrUWTKtOd/o06:SdHSwn5eY5V2bd8b

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2108	2160	Collapse.exe	30
PID 2160 wrote to memory of 2108	2160	Collapse.exe	30
PID 2160 wrote to memory of 2108	2160	Collapse.exe	30
PID 2160 wrote to memory of 2108	2160	Collapse.exe	30

C:\Users\Admin\AppData\Local\Temp\Collapse.exe
"C:\Users\Admin\AppData\Local\Temp\Collapse.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:2108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads