1fa0ac0a019a301a4e8e20ad7e27b89d86540318d84ed530f1ee8a695b9fe293 | Triage™

Analysis

max time kernel
4294180s
max time network
132s
platform
windows7_x64
resource
win7-20220311-en
submitted
30/03/2022, 17:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kendrickzx.exe
Size 573KB
Sample220330-wf94rafbf5
SHA256 1fa0ac0a019a301a4e8e20ad7e27b89d86540318d84ed530f1ee8a695b9fe293
MD5 c9d1ee54a4f73fe963fc375449c87c1e
SHA1 4f3a048ce14561efdab00085fa27b3ecb405f9a3
SHA512 a62603c41d37db472e650c0e50fe5469cc1674737cdca74b1d32a9ca0f6ab8c30b80f9d19e4be71a4d5942f5d4220a29d79c6e7f5b79aa0718a24e0eafb316c9
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
308	1664	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 308	1664	kendrickzx.exe	27
PID 1664 wrote to memory of 308	1664	kendrickzx.exe	27
PID 1664 wrote to memory of 308	1664	kendrickzx.exe	27
PID 1664 wrote to memory of 308	1664	kendrickzx.exe	27

C:\Users\Admin\AppData\Local\Temp\kendrickzx.exe
"C:\Users\Admin\AppData\Local\Temp\kendrickzx.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 644
  2⤵
  - Program crash
  PID:308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1664-54-0x0000000000AE0000-0x0000000000B76000-memory.dmp

Download