4df143666ec904e3fdc9b321b6105900dc5d6133736c2c836a47a5c2bc18c6ba | Triage

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220414-en
submitted
06-05-2022 11:51

Sharing

Report Analysis Logs

General

Target

1952-68-0x0000000000D70000-0x00000000014E8000-memory.exe
Size

7.5MB
MD5

02f2e9e5fad56ff83db2a8ac587e3c94
SHA1

998b6c542b68b8ba5bbf94e48fd7d49a74369707
SHA256

4df143666ec904e3fdc9b321b6105900dc5d6133736c2c836a47a5c2bc18c6ba
SHA512

f5d49e903bd37a5dd1ef58814962b8939f627d1d13e1816b6bc9a2793d1ba2cf73c319a6679f22106d24f9a0ad5d762eff1c817d4e4febad23a73e096946f022

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1292 836 WerFault.exe 1952-68-0x0000000000D70000-0x00000000014E8000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1952-68-0x0000000000D70000-0x00000000014E8000-memory.exe

description	pid	process	target process
PID 836 wrote to memory of 1292	836	1952-68-0x0000000000D70000-0x00000000014E8000-memory.exe	WerFault.exe
PID 836 wrote to memory of 1292	836	1952-68-0x0000000000D70000-0x00000000014E8000-memory.exe	WerFault.exe
PID 836 wrote to memory of 1292	836	1952-68-0x0000000000D70000-0x00000000014E8000-memory.exe	WerFault.exe
PID 836 wrote to memory of 1292	836	1952-68-0x0000000000D70000-0x00000000014E8000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1952-68-0x0000000000D70000-0x00000000014E8000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1952-68-0x0000000000D70000-0x00000000014E8000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 836 -s 36
2⤵
- Program crash
PID:1292

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1292-54-0x0000000000000000-mapping.dmp

Download