63ce1d90d0fc261f2b5daa7d7c96c265c4a758e0e1ea4e7a915f9e0d92c332a5 | Triage

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
10-01-2025 15:51

Sharing

Report Analysis Logs

General

Target

Stub/net5.0/ref/Obfs.exe
Size

14KB
MD5

ec9ec0b0d487d0c9d29e55c56753b864
SHA1

e75720cc8f21eed5bcbef71062c16b737ade9c91
SHA256

6e4a5284e68f2411be0e3140a1765cf3a5cbabe575ada63d7799ee6c679c869b
SHA512

85335280a5a92f2a72edcb4dadc9250a5ee1ff36990f2bcd771eba2d98d7a65966ae179c371daf1b48139a33487c4b719866d5da7b44ae8de8283f98f46c37d2
SSDEEP

192:6diyL2uyArhfIfuGHBopK6wwaOgRndkCDg0v5tF47D:RyHtdIfthiKt0mndkCZo

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2788	2204	Obfs.exe	31
PID 2204 wrote to memory of 2788	2204	Obfs.exe	31
PID 2204 wrote to memory of 2788	2204	Obfs.exe	31

C:\Users\Admin\AppData\Local\Temp\Stub\net5.0\ref\Obfs.exe
"C:\Users\Admin\AppData\Local\Temp\Stub\net5.0\ref\Obfs.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2204 -s 488
  2⤵
  PID:2788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2204-0-0x000007FEF6503000-0x000007FEF6504000-memory.dmp

Filesize
4KB

Download
memory/2204-1-0x00000000008C0000-0x00000000008CC000-memory.dmp

Filesize
48KB

Download