750cbba9a36859b978bfe5f082be44815027bc74dc2728210abbcba828ce6f56 | Triage™

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220331-en
submitted
13/04/2022, 09:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
750cbba9a36859b978bfe5f082be44815027bc74dc2728210abbcba828ce6f56.exe
Size 624KB
Sample220413-lyxahaeca9
SHA256 750cbba9a36859b978bfe5f082be44815027bc74dc2728210abbcba828ce6f56
MD5 efc6f1f3bbab26ba2cbdd60ac0eba52e
SHA1 08faebfaed9cab5a1b380e124787e63215b8ef42
SHA512 0ae1690be156e26a2da39386f25800b6b7cd4e330c4bd5006943c891c9e840865ce87895624d1f6df0f228ce2ee70de6d400ab1f26746ebed9856bbf14c43025
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1080	1548	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 1080	1548	750cbba9a36859b978bfe5f082be44815027bc74dc2728210abbcba828ce6f56.exe	29
PID 1548 wrote to memory of 1080	1548	750cbba9a36859b978bfe5f082be44815027bc74dc2728210abbcba828ce6f56.exe	29
PID 1548 wrote to memory of 1080	1548	750cbba9a36859b978bfe5f082be44815027bc74dc2728210abbcba828ce6f56.exe	29
PID 1548 wrote to memory of 1080	1548	750cbba9a36859b978bfe5f082be44815027bc74dc2728210abbcba828ce6f56.exe	29

C:\Users\Admin\AppData\Local\Temp\750cbba9a36859b978bfe5f082be44815027bc74dc2728210abbcba828ce6f56.exe
"C:\Users\Admin\AppData\Local\Temp\750cbba9a36859b978bfe5f082be44815027bc74dc2728210abbcba828ce6f56.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 156
  2⤵
  - Program crash
  PID:1080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1548-54-0x0000000076A51000-0x0000000076A53000-memory.dmp

Download