d94747c37a0fc39c242375bb649d146a469ed3d49771048c024f96170ad5d85a | Triage

Analysis

max time kernel
4294181s
max time network
132s
platform
windows7_x64
resource
win7-20220311-en
submitted
26-03-2022 12:49

Sharing

Report Analysis Logs

General

Target

new.exe
Size

204KB
MD5

83ad1aef29c044fc8a630711be34b420
SHA1

dda0ae0fe60b1322aa99151472d1d98518238be9
SHA256

d94747c37a0fc39c242375bb649d146a469ed3d49771048c024f96170ad5d85a
SHA512

e6951c48e00fb41cae729240c7829cad268627f141ba22178a8d2d6b717bb387d6b7723f03b575f0b596e77466ddd7ab83be284e78e2588edc8f1981cf543383

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

788 1044 WerFault.exe new.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

new.exe

description	pid	process	target process
PID 1044 wrote to memory of 788	1044	new.exe	WerFault.exe
PID 1044 wrote to memory of 788	1044	new.exe	WerFault.exe
PID 1044 wrote to memory of 788	1044	new.exe	WerFault.exe
PID 1044 wrote to memory of 788	1044	new.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\new.exe
"C:\Users\Admin\AppData\Local\Temp\new.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 204
  2⤵
  - Program crash
  PID:788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/788-55-0x0000000000000000-mapping.dmp

Download
memory/1044-54-0x00000000749A1000-0x00000000749A3000-memory.dmp

Filesize
8KB

Download