63ce1d90d0fc261f2b5daa7d7c96c265c4a758e0e1ea4e7a915f9e0d92c332a5 | Triage

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-01-2025 15:51

Sharing

Report Analysis Logs

General

Target

Stub/Loader.exe
Size

5KB
MD5

3225ce4873a8b6b94ddea9e18e2445f6
SHA1

6437d33dc2e0eca711d6a80ef9fa87a5dd21a75f
SHA256

679f0abb99cb973e2164b51408f2863091e5dabf3fe7729a8683360a92c69db5
SHA512

fb7bb26572ef0174fc4eb921d286877e176aaecf83057ae862324406d25d3e3c7406f10991fb01ae3924f57c5fa5f8215712e0fba6aa0d68402ef8746bc14eed
SSDEEP

48:6jspjNKjkecyNMF+e9Bz/b986sgamLmTZsFtoJlShKtF:+CEW3+e9BzLslmLm7e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2752	2156	Loader.exe	30
PID 2156 wrote to memory of 2752	2156	Loader.exe	30
PID 2156 wrote to memory of 2752	2156	Loader.exe	30

C:\Users\Admin\AppData\Local\Temp\Stub\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Stub\Loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2156 -s 524
  2⤵
  PID:2752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2156-0-0x000007FEF4D23000-0x000007FEF4D24000-memory.dmp

Filesize
4KB

Download
memory/2156-1-0x00000000011D0000-0x00000000011D8000-memory.dmp

Filesize
32KB

Download