7dc826deb7225c544091b7a33f6e9093617941d90fba7c5b5057ff97e231270f | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-02-2025 18:25

Sharing

Report Analysis Logs

General

Target

Source.exe
Size

1.2MB
MD5

6179f45e49ae7257c1fb5859dc119f73
SHA1

14b8a63e92e4d9254a3949f841631b96f5eaa590
SHA256

7dc826deb7225c544091b7a33f6e9093617941d90fba7c5b5057ff97e231270f
SHA512

6f492fa5a1c7ba28c269355f80e316db05186ffd9ed28c72b1ce911cb8f46a10049fcfd09008ee99996194f4d154eb46e8b7af98c31db98a4a3690397a46b519
SSDEEP

24576:CoJOLUTJcMfM2kO9shrYgTnwxznA1sUo1sUa2hZU6EmC3Fp39zZF35:7BnLUDUZi6EZFbVb

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2984	2528	Source.exe	31
PID 2528 wrote to memory of 2984	2528	Source.exe	31
PID 2528 wrote to memory of 2984	2528	Source.exe	31
PID 2528 wrote to memory of 972	2528	Source.exe	32
PID 2528 wrote to memory of 972	2528	Source.exe	32
PID 2528 wrote to memory of 972	2528	Source.exe	32
PID 2528 wrote to memory of 2272	2528	Source.exe	33
PID 2528 wrote to memory of 2272	2528	Source.exe	33
PID 2528 wrote to memory of 2272	2528	Source.exe	33

C:\Users\Admin\AppData\Local\Temp\Source.exe
"C:\Users\Admin\AppData\Local\Temp\Source.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:972
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2528 -s 132
  2⤵
  PID:2272

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads