750cbba9a36859b978bfe5f082be44815027bc74dc2728210abbcba828ce6f56 | Triage

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220331-en
submitted
13-04-2022 09:57

Sharing

Report Analysis Logs

General

Target

750cbba9a36859b978bfe5f082be44815027bc74dc2728210abbcba828ce6f56.exe
Size

624KB
MD5

efc6f1f3bbab26ba2cbdd60ac0eba52e
SHA1

08faebfaed9cab5a1b380e124787e63215b8ef42
SHA256

750cbba9a36859b978bfe5f082be44815027bc74dc2728210abbcba828ce6f56
SHA512

0ae1690be156e26a2da39386f25800b6b7cd4e330c4bd5006943c891c9e840865ce87895624d1f6df0f228ce2ee70de6d400ab1f26746ebed9856bbf14c43025

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1080 1548 WerFault.exe 750cbba9a36859b978bfe5f082be44815027bc74dc2728210abbcba828ce6f56.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

750cbba9a36859b978bfe5f082be44815027bc74dc2728210abbcba828ce6f56.exe

description	pid	process	target process
PID 1548 wrote to memory of 1080	1548	750cbba9a36859b978bfe5f082be44815027bc74dc2728210abbcba828ce6f56.exe	WerFault.exe
PID 1548 wrote to memory of 1080	1548	750cbba9a36859b978bfe5f082be44815027bc74dc2728210abbcba828ce6f56.exe	WerFault.exe
PID 1548 wrote to memory of 1080	1548	750cbba9a36859b978bfe5f082be44815027bc74dc2728210abbcba828ce6f56.exe	WerFault.exe
PID 1548 wrote to memory of 1080	1548	750cbba9a36859b978bfe5f082be44815027bc74dc2728210abbcba828ce6f56.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\750cbba9a36859b978bfe5f082be44815027bc74dc2728210abbcba828ce6f56.exe
"C:\Users\Admin\AppData\Local\Temp\750cbba9a36859b978bfe5f082be44815027bc74dc2728210abbcba828ce6f56.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 156
  2⤵
  - Program crash
  PID:1080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1080-55-0x0000000000000000-mapping.dmp

Download
memory/1548-54-0x0000000076A51000-0x0000000076A53000-memory.dmp

Filesize
8KB

Download