cb8b98537cfd5101d1ff182c696cb16fc6478822f6c7deced4efc08b6b02114a | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 16:59

Sharing

Report Analysis Logs

General

Target

github.software.1.2.4.exe
Size

512KB
MD5

40e2eec44440b05252d597d1f3a7c322
SHA1

9a5ee75fdba536d3e954e70c58597e96a6921658
SHA256

cb8b98537cfd5101d1ff182c696cb16fc6478822f6c7deced4efc08b6b02114a
SHA512

325c54743904c7f183d46b7fd16686f0594bd41f85954b8237fcd455542b981804accc65decc4535b0b4122d6be8c41d2470b9f0bc991bf8a4beda14800506d3
SSDEEP

12288:YBzlsxxxMCQMQA1cR0HB7Ndtjpw2zw1ybLnOMA:Y5iDxWIciHB7jxzw1ybLn

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2980 1768 WerFault.exe github.software.1.2.4.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

github.software.1.2.4.exe

description	pid	process	target process
PID 1768 wrote to memory of 2980	1768	github.software.1.2.4.exe	WerFault.exe
PID 1768 wrote to memory of 2980	1768	github.software.1.2.4.exe	WerFault.exe
PID 1768 wrote to memory of 2980	1768	github.software.1.2.4.exe	WerFault.exe
PID 1768 wrote to memory of 2980	1768	github.software.1.2.4.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\github.software.1.2.4.exe
"C:\Users\Admin\AppData\Local\Temp\github.software.1.2.4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 96
2⤵
- Program crash
PID:2980

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1768-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download