aa7e5c5ab042b539c1ccaebe7c129bb54da0731be955dcfa328324ca776e3b01 | Triage

Analysis

max time kernel
4294181s
max time network
124s
platform
windows7_x64
resource
win7-20220311-en
submitted
31-03-2022 14:23

Sharing

Report Analysis Logs

General

Target

RQF #00811-AL WASL .exe
Size

721KB
MD5

3f8326ef5a02e2b20b6692ed3a4153ce
SHA1

5fa01330c418fc54fd57481f60a32eece6caa456
SHA256

aa7e5c5ab042b539c1ccaebe7c129bb54da0731be955dcfa328324ca776e3b01
SHA512

aabc56ae6c531c3402a4b399a9682eca99ff1198d1e8bbbdc2dfb201aed55d3036448af819363d38aaefd8674838969c7149e5821009759ecbf95c9269f6c6f3

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

584 1964 WerFault.exe RQF #00811-AL WASL .exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

RQF #00811-AL WASL .exe

description	pid	process	target process
PID 1964 wrote to memory of 584	1964	RQF #00811-AL WASL .exe	WerFault.exe
PID 1964 wrote to memory of 584	1964	RQF #00811-AL WASL .exe	WerFault.exe
PID 1964 wrote to memory of 584	1964	RQF #00811-AL WASL .exe	WerFault.exe
PID 1964 wrote to memory of 584	1964	RQF #00811-AL WASL .exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\RQF #00811-AL WASL .exe
"C:\Users\Admin\AppData\Local\Temp\RQF #00811-AL WASL .exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 540
2⤵
- Program crash
PID:584

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/584-55-0x0000000000000000-mapping.dmp

Download
memory/1964-54-0x0000000000FC0000-0x000000000107A000-memory.dmp

Filesize
744KB

Download