597967017af5b99604f5b8135ba5da3929d447937ef96d6d08750c71b1ad8b57 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/01/2025, 21:06

Sharing

Report Analysis Logs

General

Target

DiceBot 5.0.4/DiceBot 5.0.4.exe
Size

178KB
MD5

109ffbefe8cccafc6db7276baa45be0f
SHA1

df7300d951756013db8b820ce4b4044559fe83d1
SHA256

647de53b1d9e75ec2ff48838924ddd00799d05c0d61af111a842a59621a90f7c
SHA512

13af9f6925cb22bb2b4c644e6737d37e508c1a53677942619c415265e4a9b699769df7406d6409dad5198c428bf66c54cf33490a2b98450546b73a68422793d5
SSDEEP

768:mj+HObZiwMBp7jlP9LWJz9AktYcF2l1x6KOFn60KS:m9bZi7B0QY21xlOFn60KS

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2320	1924	DiceBot 5.0.4.exe	32
PID 1924 wrote to memory of 2320	1924	DiceBot 5.0.4.exe	32
PID 1924 wrote to memory of 2320	1924	DiceBot 5.0.4.exe	32

C:\Users\Admin\AppData\Local\Temp\DiceBot 5.0.4\DiceBot 5.0.4.exe
"C:\Users\Admin\AppData\Local\Temp\DiceBot 5.0.4\DiceBot 5.0.4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1924 -s 516
  2⤵
  PID:2320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1924-0-0x000007FEF52A3000-0x000007FEF52A4000-memory.dmp

Filesize
4KB

Download
memory/1924-1-0x000000013F800000-0x000000013F82E000-memory.dmp

Filesize
184KB

Download