bd54a05941657f9fae17adcb35ce3f427411e8c40c56fb8cc9dce9a9f93a447a | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-02-2025 16:03

Sharing

Report Analysis Logs

General

Target

AthenaX SS/Dapper.exe
Size

285KB
MD5

b7df8d82037c9954a3aa81d76e6cc55b
SHA1

87040f1a81f5bb4ffec9acc22b4e56881c2f87ad
SHA256

982ceecec1edec7eefb8e33981955a1c2d4f6f855335da28ee32555fe0f06fb4
SHA512

2da59c7d3cc372075fd6d9042db7dfec5b9412a9926b799d0070bf329fc16b902e884116d3d070e27c450e1ef256c5e2d226a602396468fc75b817cd48e525ec
SSDEEP

6144:zxbx/Pu87pvJ2BsUGLmrsqZpAMycZJYYcNI/b4Y5pScOTgy:9ZPuUvEOLsdZp3rD4IT4Yjy

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 3036	2440	Dapper.exe	32
PID 2440 wrote to memory of 3036	2440	Dapper.exe	32
PID 2440 wrote to memory of 3036	2440	Dapper.exe	32

C:\Users\Admin\AppData\Local\Temp\AthenaX SS\Dapper.exe
"C:\Users\Admin\AppData\Local\Temp\AthenaX SS\Dapper.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2440 -s 516
  2⤵
  PID:3036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2440-1-0x0000000000B10000-0x0000000000B5E000-memory.dmp

Filesize
312KB

Download
memory/2440-0-0x000007FEF5FE3000-0x000007FEF5FE4000-memory.dmp

Filesize
4KB

Download