fe1f268ea15153b6f0e9935ce18b75a2da354ab2f84c3662b29e21054bf2cc22 | Triage™

Analysis

max time kernel
4294179s
max time network
121s
platform
windows7_x64
resource
win7-20220311-en
submitted
06/04/2022, 17:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Tender notification05.04..2022.doc.exe
Size 842KB
Sample220406-v2l4dacefl
SHA256 fe1f268ea15153b6f0e9935ce18b75a2da354ab2f84c3662b29e21054bf2cc22
MD5 6aa089da1b3580a1aaefdc3f7b7856fa
SHA1 32cb589bbcae3f339d6ecd0a5a68231a50b2a92c
SHA512 5bccc21a1a74defb1d37acabe7cf582be607872276918f1fdb86d2c91472c720e89f0ac4e4be272f2322b06d7dc1d17d8e8d7db94dd1ec2cafda686400ee554b
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1476	1604	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 1476	1604	Tender notification05.04..2022.doc.exe	27
PID 1604 wrote to memory of 1476	1604	Tender notification05.04..2022.doc.exe	27
PID 1604 wrote to memory of 1476	1604	Tender notification05.04..2022.doc.exe	27
PID 1604 wrote to memory of 1476	1604	Tender notification05.04..2022.doc.exe	27

C:\Users\Admin\AppData\Local\Temp\Tender notification05.04..2022.doc.exe
"C:\Users\Admin\AppData\Local\Temp\Tender notification05.04..2022.doc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 644
  2⤵
  - Program crash
  PID:1476

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1604-54-0x0000000000D20000-0x0000000000DF8000-memory.dmp

Download