cda9310715b7a12f47b7c134260d5ff9200c147fc1d05f030e507e57e3582327 | Triage

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220414-en
submitted
26-04-2022 19:10

Sharing

Report Analysis Logs

General

Target

9ec8468dd4a81b0b35c499b31e67375e.industroyer2.exe
Size

624KB
MD5

9ec8468dd4a81b0b35c499b31e67375e
SHA1

6fa04992c0624c7aa3ca80da6a30e6de91226a16
SHA256

cda9310715b7a12f47b7c134260d5ff9200c147fc1d05f030e507e57e3582327
SHA512

bd6b37a0395f0ae508c54dcb62d5258adfb8c202605db8310c6b8758c3874bd2364491b1b129209ba1854df27f35149f891ac785a89fe26ddc45c40cad8023b2

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

836 960 WerFault.exe 9ec8468dd4a81b0b35c499b31e67375e.industroyer2.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

9ec8468dd4a81b0b35c499b31e67375e.industroyer2.exe

description	pid	process	target process
PID 960 wrote to memory of 836	960	9ec8468dd4a81b0b35c499b31e67375e.industroyer2.exe	WerFault.exe
PID 960 wrote to memory of 836	960	9ec8468dd4a81b0b35c499b31e67375e.industroyer2.exe	WerFault.exe
PID 960 wrote to memory of 836	960	9ec8468dd4a81b0b35c499b31e67375e.industroyer2.exe	WerFault.exe
PID 960 wrote to memory of 836	960	9ec8468dd4a81b0b35c499b31e67375e.industroyer2.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\9ec8468dd4a81b0b35c499b31e67375e.industroyer2.exe
"C:\Users\Admin\AppData\Local\Temp\9ec8468dd4a81b0b35c499b31e67375e.industroyer2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 960 -s 156
  2⤵
  - Program crash
  PID:836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/836-55-0x0000000000000000-mapping.dmp

Download
memory/960-54-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

Filesize
8KB

Download