6f1cdc079812115df46d5cfc629e9ed8a9ed0d8d717de8d28bc9890b5578af4d | Triage

Analysis

max time kernel
9s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
28/03/2025, 17:33

Sharing

Report Analysis Logs

General

Target

sheet rat v2.6/Stub/Client.exe
Size

47KB
MD5

a0e04bf9b43f0b442bd3193f06dc52b5
SHA1

30bb0c17640c414d948ed3e2fdf571b98f125efb
SHA256

71824238c3baec179911bd6e4655ebff234e15d0f14248077e2c388ef4337009
SHA512

d7015f5c8223ba0f4e3b478185fa3e4de0831aee949302185fdc8b3afe59105fe096a3e5ee23219a1c16dfcbc77d169a82774ecd727ef98bdb94a878583a2ae2
SSDEEP

768:+nqRz+Q9CF6abcLPbUG9bOplP7ZXdEEyb:B9g6asD79bOHLDu

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 2184	1356	Client.exe	29
PID 1356 wrote to memory of 2184	1356	Client.exe	29
PID 1356 wrote to memory of 2184	1356	Client.exe	29

C:\Users\Admin\AppData\Local\Temp\sheet rat v2.6\Stub\Client.exe
"C:\Users\Admin\AppData\Local\Temp\sheet rat v2.6\Stub\Client.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1356 -s 524
  2⤵
  PID:2184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1356-0-0x000007FEF5E03000-0x000007FEF5E04000-memory.dmp

Filesize
4KB

Download
memory/1356-1-0x0000000000C10000-0x0000000000C22000-memory.dmp

Filesize
72KB

Download