abf138e9dea16b8da182e63a1e7d49a59ee57c792a77c3de34f379ceb0923d6a | Triage

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/01/2025, 02:06

Sharing

Report Analysis Logs

General

Target

Steamtools New Version/SomeWeirdApp.exe
Size

64KB
MD5

2268d5e30e4e843a120aae29de1e6f88
SHA1

a74c23e0b83c262df97a87bcb9e3da20482d0eba
SHA256

42b5ff6aa823147c0c6a7b479d8db92b3d6f5428b137850d9c21808d8fb7af28
SHA512

672fad72bb78c9f872fcbd89e1f8ab10326d0ab3b1ae2cdc36426797def82f4b8646d14f2a851091e1359210687b1ba391d6357e6d1f60ec3562fbb3098b5cb6
SSDEEP

1536:CwnU/2TZdHif2pALN01XcXXbMw9ARdMJW+Hjz6:ClMTifNXXbhKRdgW+Hjm

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 3020	2244	SomeWeirdApp.exe	31
PID 2244 wrote to memory of 3020	2244	SomeWeirdApp.exe	31
PID 2244 wrote to memory of 3020	2244	SomeWeirdApp.exe	31

C:\Users\Admin\AppData\Local\Temp\Steamtools New Version\SomeWeirdApp.exe
"C:\Users\Admin\AppData\Local\Temp\Steamtools New Version\SomeWeirdApp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2244 -s 500
  2⤵
  PID:3020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2244-0-0x000007FEF5C83000-0x000007FEF5C84000-memory.dmp

Filesize
4KB

Download
memory/2244-1-0x0000000001200000-0x0000000001216000-memory.dmp

Filesize
88KB

Download