ebcd0c7de9878d9c83848e8adf3b135c34ede61cf39caede45ea3f2855c77e43 | Triage™

Analysis

max time kernel
112s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
08/03/2022, 18:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5bf430688deacda4290f9efdcca428cb.exe
Size 1.1MB
Sample220308-w52tnsdcdn
SHA256 ebcd0c7de9878d9c83848e8adf3b135c34ede61cf39caede45ea3f2855c77e43
MD5 5bf430688deacda4290f9efdcca428cb
SHA1 1c60953e8782879af4dc21c761530693bf052612
SHA512 1a243a324d3dcdfee0487dc1548886a6d8d99f9e5c256f988cac91e8e874b0130e924ad1c08bf725dc8cc5d1f018a4c60d5f9004ffd37da681326a3eb9986994
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5112	2620	WerFault.exe	79
448	2620	WerFault.exe	79

C:\Users\Admin\AppData\Local\Temp\5bf430688deacda4290f9efdcca428cb.exe
"C:\Users\Admin\AppData\Local\Temp\5bf430688deacda4290f9efdcca428cb.exe"
1⤵
PID:2620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 472
  2⤵
  - Program crash
  PID:5112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 480
  2⤵
  - Program crash
  PID:448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2620 -ip 2620
1⤵
PID:4824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2620 -ip 2620
1⤵
PID:5064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2620-130-0x0000000002640000-0x00000000026A0000-memory.dmp

Download