a51e73ec5bca72dcebd78f128e76fa4bcb942ee0509d9c549e721806301a3e13 | Triage™

Analysis

max time kernel
47s
max time network
153s
platform
windows7_x64
resource
win7-20220414-en
submitted
18/04/2022, 05:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rx.exe
Size 899KB
Sample220418-gdfd2afbc5
SHA256 a51e73ec5bca72dcebd78f128e76fa4bcb942ee0509d9c549e721806301a3e13
MD5 e8c8cafdaec84cb6b02b4481309164f8
SHA1 08168ca91474ca247984f6caa92d0e90f7a4c09a
SHA512 6bc12b1af297537a3b160ecdcede2e2b849e9b6f03a654ea0dd26a9903d68ba61da3191dd1f41a474b94f67713bcb4e12acb4db003acce0eb0fc3abf1dd29c92
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1740	1984	WerFault.exe	17

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 1740	1984	rx.exe	28
PID 1984 wrote to memory of 1740	1984	rx.exe	28
PID 1984 wrote to memory of 1740	1984	rx.exe	28
PID 1984 wrote to memory of 1740	1984	rx.exe	28

C:\Users\Admin\AppData\Local\Temp\rx.exe
"C:\Users\Admin\AppData\Local\Temp\rx.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 804
  2⤵
  - Program crash
  PID:1740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1984-54-0x00000000756E1000-0x00000000756E3000-memory.dmp

Download