d59bc73103668278d2831c989d841bc931edda65b0ea30c710fb33be0145fd89 | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
14/03/2025, 23:23

Sharing

Report Analysis Logs

General

Target

Setup.exe
Size

485KB
MD5

3a69ddb5e4380286143054fb5ec33002
SHA1

b8fde1d312025a8b8c4cd9f562f3e379bc058afc
SHA256

00841e878ca166421fd11488b34576cb2910137c5ad94d1950c11bd2131ae0dc
SHA512

1c20848d194972e4894f96561cde864cfb248210cc3cc4a0c3bde8dcee79d7ca79351dc6db29ca4b6c257ec408d1a02294e5d8c92dffea9441a1a3aff194069e
SSDEEP

12288:DAJ0SiRi56OgIuETl5qGlsecGHaRsuAVHETqpVEe1v3WxAo:s0S4gtTTlkG6FDmp7QAo

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2372	1712	Setup.exe	31
PID 1712 wrote to memory of 2372	1712	Setup.exe	31
PID 1712 wrote to memory of 2372	1712	Setup.exe	31

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1712 -s 36
  2⤵
  PID:2372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads