d7d7882cc702fc76252e2b4fe7cdc7fbffa038e2329e579142e64acf81a26304 | Triage™

Analysis

max time kernel
160s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
07/03/2022, 10:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IRAN INVOICE.exe
Size 657KB
Sample220307-mas4lsdbf5
SHA256 d7d7882cc702fc76252e2b4fe7cdc7fbffa038e2329e579142e64acf81a26304
MD5 6c35db388f70368e4a83b971fab041bb
SHA1 ba6b80be8883c7a4da92417e7cb355ae299466f4
SHA512 67676f08997664efe36a56bf603e093b18b2738657f5fef12bdbebbaf39c5aacfe1f32f8116c82212c1b0264e975af19df1e0b7bba1460e2d2e5a32ef84c0325
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4692	2484	WerFault.exe	79
2828	2484	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 4692	2484	IRAN INVOICE.exe	95
PID 2484 wrote to memory of 4692	2484	IRAN INVOICE.exe	95
PID 2484 wrote to memory of 4692	2484	IRAN INVOICE.exe	95

C:\Users\Admin\AppData\Local\Temp\IRAN INVOICE.exe
"C:\Users\Admin\AppData\Local\Temp\IRAN INVOICE.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 1952
  2⤵
  - Program crash
  PID:4692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 1952
  2⤵
  - Program crash
  PID:2828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2484 -ip 2484
1⤵
PID:3672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2484-130-0x00000000006A0000-0x00000000006A1000-memory.dmp

Download

memory/2484-132-0x0000000000400000-0x00000000004AB000-memory.dmp

Download