2522eb074537e2ea01f643fb1d5d4b7f5ab8d3f7cb6524f230ff5521c362cc3f | Triage™

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220331-en
submitted
05/04/2022, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dhl details.pdf.exe
Size 791KB
Sample220405-wtql9sbbe3
SHA256 2522eb074537e2ea01f643fb1d5d4b7f5ab8d3f7cb6524f230ff5521c362cc3f
MD5 4ba915e37a548acb28771fa42c6ca8ea
SHA1 de84ce87fdfb0b74e5207e088dc4dd6bd78e2bab
SHA512 b5b9991582acf76f38f4d20dc1b28849b293d293efab6e1ffc1168a268decb62f2599f6956fb31b2acda9a1858f4556f0eb9422a23c209832950e9c8c182db59
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1844	308	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 308 wrote to memory of 1844	308	dhl details.pdf.exe	27
PID 308 wrote to memory of 1844	308	dhl details.pdf.exe	27
PID 308 wrote to memory of 1844	308	dhl details.pdf.exe	27
PID 308 wrote to memory of 1844	308	dhl details.pdf.exe	27

C:\Users\Admin\AppData\Local\Temp\dhl details.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\dhl details.pdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:308
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 308 -s 644
  2⤵
  - Program crash
  PID:1844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/308-54-0x0000000000030000-0x00000000000FC000-memory.dmp

Download