783a0ab9ef1ce64fb9390ad9906cdeed76cf978b36c0f5eedbc9e2b18a0ad8da | Triage™

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220331-en
submitted
05/04/2022, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
88000000027160022_07019STC.exe
Size 849KB
Sample220405-mtdg9sdee2
SHA256 783a0ab9ef1ce64fb9390ad9906cdeed76cf978b36c0f5eedbc9e2b18a0ad8da
MD5 d9c6f3ac514c8df59df11ca9856d8761
SHA1 056b015bbc224f4822955237e5918365fa1dde71
SHA512 c4fa6bc8ac5a0c3bbf4e5cd00501f97aec727fec38a058b4cb51e910bec9e653d4153340bf0afa591b136c5090f472310c4acba29b6e34286dc0e634756d4343
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
284	1052	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 284	1052	88000000027160022_07019STC.exe	28
PID 1052 wrote to memory of 284	1052	88000000027160022_07019STC.exe	28
PID 1052 wrote to memory of 284	1052	88000000027160022_07019STC.exe	28
PID 1052 wrote to memory of 284	1052	88000000027160022_07019STC.exe	28

C:\Users\Admin\AppData\Local\Temp\88000000027160022_07019STC.exe
"C:\Users\Admin\AppData\Local\Temp\88000000027160022_07019STC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 644
  2⤵
  - Program crash
  PID:284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1052-54-0x0000000001150000-0x000000000122A000-memory.dmp

Download