f4461e8b0f3831b6ee77d57f52dd74f28e79114bc5bb29d6b7ab5ca3adbf27f6 | Triage

Analysis

max time kernel
43s
max time network
49s
platform
windows7_x64
resource
win7-20220414-en
submitted
14-05-2022 13:50

Sharing

Report Analysis Logs

General

Target

f4461e8b0f3831b6ee77d57f52dd74f28e79114bc5bb29d6b7ab5ca3adbf27f6.exe
Size

367KB
MD5

e426c21445dae36d36bb5d1cfe9d383b
SHA1

bfc79210d073fdb6511bdf6a0b519cc29cebbc3b
SHA256

f4461e8b0f3831b6ee77d57f52dd74f28e79114bc5bb29d6b7ab5ca3adbf27f6
SHA512

096d36231581a894d5e9a07bb8fbe6ba483b92545a32040d448519c7b0de417bce836a1c817dd0ddf5bb98483a4c17dd3013674b6275ffacdfa2155ab32ef3a0

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

944 1044 WerFault.exe f4461e8b0f3831b6ee77d57f52dd74f28e79114bc5bb29d6b7ab5ca3adbf27f6.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

f4461e8b0f3831b6ee77d57f52dd74f28e79114bc5bb29d6b7ab5ca3adbf27f6.exe

description	pid	process	target process
PID 1044 wrote to memory of 944	1044	f4461e8b0f3831b6ee77d57f52dd74f28e79114bc5bb29d6b7ab5ca3adbf27f6.exe	WerFault.exe
PID 1044 wrote to memory of 944	1044	f4461e8b0f3831b6ee77d57f52dd74f28e79114bc5bb29d6b7ab5ca3adbf27f6.exe	WerFault.exe
PID 1044 wrote to memory of 944	1044	f4461e8b0f3831b6ee77d57f52dd74f28e79114bc5bb29d6b7ab5ca3adbf27f6.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\f4461e8b0f3831b6ee77d57f52dd74f28e79114bc5bb29d6b7ab5ca3adbf27f6.exe
"C:\Users\Admin\AppData\Local\Temp\f4461e8b0f3831b6ee77d57f52dd74f28e79114bc5bb29d6b7ab5ca3adbf27f6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1044

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1044 -s 616
2⤵
- Program crash
PID:944

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/944-55-0x0000000000000000-mapping.dmp

Download
memory/1044-54-0x00000000002F0000-0x0000000000354000-memory.dmp

Filesize
400KB

Download