cb1bcf331721008e6dd6b46cd0f1880612374d54403836f43f264f924789e610 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 13:24

Sharing

Report Analysis Logs

General

Target

maizu hack v1.4/maizu hack v1.4.exe
Size

507KB
MD5

5241cbe1ca5ad91d9701dcd3e86d0be4
SHA1

42e2343018e6f26747f21310e1498a0b7558cee7
SHA256

18b8ddccfd60b09d5e7148f3a5ce61c61d37da4de9e4206ad28155ad92d70a5d
SHA512

208b7e3efce893a7a766d03f5185f065e0067b100ec5917fe9a3030906ce0740669d95ad2a128cdecf7cd70051cd04e1befa1fec5ce855a6a016016ae25950e1
SSDEEP

12288:1+0NNkaifVNXUYLnft4Com2511gYTqKoGlGnzc:17yaCTXU+t4CoP5FTxoG

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2516 1988 WerFault.exe maizu hack v1.4.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

maizu hack v1.4.exe

description	pid	process	target process
PID 1988 wrote to memory of 2516	1988	maizu hack v1.4.exe	WerFault.exe
PID 1988 wrote to memory of 2516	1988	maizu hack v1.4.exe	WerFault.exe
PID 1988 wrote to memory of 2516	1988	maizu hack v1.4.exe	WerFault.exe
PID 1988 wrote to memory of 2516	1988	maizu hack v1.4.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\maizu hack v1.4\maizu hack v1.4.exe
"C:\Users\Admin\AppData\Local\Temp\maizu hack v1.4\maizu hack v1.4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 96
2⤵
- Program crash
PID:2516

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1988-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download