334532817a3d2ab7c3043fe908ca9040c4f4fc82ac7cb640f3e64befa0773d3b | Triage™

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220331-en
submitted
05/04/2022, 05:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kHOCeq3NWohVYTq.exe
Size 758KB
Sample220405-fx5btsdddl
SHA256 334532817a3d2ab7c3043fe908ca9040c4f4fc82ac7cb640f3e64befa0773d3b
MD5 32afe614ea910cca4c4ca2f1ce302f98
SHA1 fdce67d9d51e455c598d709f56a4466ab23f857c
SHA512 8ffb5e35353be393b3f3aad3d2f3a14286fd766dc6bae2a2417a79a1e721c75aa27d6128765607fd035d1bbeb654ca795727e44834b9f4960d5452936558cb95
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1656	1652	WerFault.exe	18

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1656	1652	kHOCeq3NWohVYTq.exe	28
PID 1652 wrote to memory of 1656	1652	kHOCeq3NWohVYTq.exe	28
PID 1652 wrote to memory of 1656	1652	kHOCeq3NWohVYTq.exe	28
PID 1652 wrote to memory of 1656	1652	kHOCeq3NWohVYTq.exe	28

C:\Users\Admin\AppData\Local\Temp\kHOCeq3NWohVYTq.exe
"C:\Users\Admin\AppData\Local\Temp\kHOCeq3NWohVYTq.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 640
  2⤵
  - Program crash
  PID:1656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1652-54-0x00000000002C0000-0x0000000000384000-memory.dmp

Download