c53cdca62beef131773c4dac2201ada2bd7e3ee2670be7a891ad382e2aa8a030 | Triage

Analysis

max time kernel
153s
max time network
49s
platform
windows7_x64
resource
win7-20220414-en
submitted
20-05-2022 03:00

Sharing

Report Analysis Logs

General

Target

HPUSBFW/HPUSBFW.exe
Size

132KB
MD5

70bfc665ab6518b4981a328837343f00
SHA1

d6d0e7b956f82e6bf793488e6c789a7d0dc86e1d
SHA256

5ed8d7188bcce496f545b044269e30955982b6cdf7fdb59779254a2c04394d09
SHA512

7ee22250758925ede7834c3b1fe9db7facac6a60ad7da2666b1fe82027faab0da31614e8f53eb71d9c3d7eab71d558aa5d703a8143611ed5d2012f92c50baefe

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1952 1836 WerFault.exe HPUSBFW.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

HPUSBFW.exe

description	pid	process	target process
PID 1836 wrote to memory of 1952	1836	HPUSBFW.exe	WerFault.exe
PID 1836 wrote to memory of 1952	1836	HPUSBFW.exe	WerFault.exe
PID 1836 wrote to memory of 1952	1836	HPUSBFW.exe	WerFault.exe
PID 1836 wrote to memory of 1952	1836	HPUSBFW.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\HPUSBFW\HPUSBFW.exe
"C:\Users\Admin\AppData\Local\Temp\HPUSBFW\HPUSBFW.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 164
2⤵
- Program crash
PID:1952

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1836-54-0x0000000074B51000-0x0000000074B53000-memory.dmp

Filesize
8KB

Download
memory/1836-56-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1952-55-0x0000000000000000-mapping.dmp

Download