5fbd74b727784725db522b21fb0b291ceaa9f99082f238c8b27977e2ab34d785 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 19:39

Sharing

Report Analysis Logs

General

Target

github.software.1.1.8.exe
Size

526KB
MD5

87f9b840bb41a3488601bbb3e4e1fbd7
SHA1

843df85b4df246a97bb93124f2d3bc8a35845792
SHA256

5fbd74b727784725db522b21fb0b291ceaa9f99082f238c8b27977e2ab34d785
SHA512

185180b8dfad633114e21c8ae00d164175634b797f9e4e9ff7a961fce4cf2cfee1edd335a97105aa49f40618eb403b5721ae264552d40245de8aa9a4010adb0a
SSDEEP

12288:dV8l+nZJDPijrLnL999fn6nVwt9suceSUvnpuY9:dmoZJji3LnL999fn6nVwvsuceSsp

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2516 1728 WerFault.exe github.software.1.1.8.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

github.software.1.1.8.exe

description	pid	process	target process
PID 1728 wrote to memory of 2516	1728	github.software.1.1.8.exe	WerFault.exe
PID 1728 wrote to memory of 2516	1728	github.software.1.1.8.exe	WerFault.exe
PID 1728 wrote to memory of 2516	1728	github.software.1.1.8.exe	WerFault.exe
PID 1728 wrote to memory of 2516	1728	github.software.1.1.8.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\github.software.1.1.8.exe
"C:\Users\Admin\AppData\Local\Temp\github.software.1.1.8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 96
2⤵
- Program crash
PID:2516

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1728-0-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download