8734c057703087fe126636fbb1fa6b367d10e8f192307987fa3d81efdf6258c1 | Triage

Analysis

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20220414-en
submitted
20-05-2022 10:29

Sharing

Report Analysis Logs

General

Target

8734C057703087FE126636FBB1FA6B367D10E8F192307.exe
Size

732KB
MD5

72373a16a801b46d2647eb6e2e146538
SHA1

1d0e360c9d24cf3c8bbbece9f43601d8abb74fc5
SHA256

8734c057703087fe126636fbb1fa6b367d10e8f192307987fa3d81efdf6258c1
SHA512

65631c8c4080493d5125c8eaac546adb45becfab653d679b54c4e3b269e0050c11fd4aa69cf073b9ecd05e2eff2f774657892fbf3e36533b850e3f019c926986

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1448 1964 WerFault.exe 8734C057703087FE126636FBB1FA6B367D10E8F192307.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

8734C057703087FE126636FBB1FA6B367D10E8F192307.exe

description	pid	process	target process
PID 1964 wrote to memory of 1448	1964	8734C057703087FE126636FBB1FA6B367D10E8F192307.exe	WerFault.exe
PID 1964 wrote to memory of 1448	1964	8734C057703087FE126636FBB1FA6B367D10E8F192307.exe	WerFault.exe
PID 1964 wrote to memory of 1448	1964	8734C057703087FE126636FBB1FA6B367D10E8F192307.exe	WerFault.exe
PID 1964 wrote to memory of 1448	1964	8734C057703087FE126636FBB1FA6B367D10E8F192307.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\8734C057703087FE126636FBB1FA6B367D10E8F192307.exe
"C:\Users\Admin\AppData\Local\Temp\8734C057703087FE126636FBB1FA6B367D10E8F192307.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 540
2⤵
- Program crash
PID:1448

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1448-55-0x0000000000000000-mapping.dmp

Download
memory/1964-54-0x0000000000D10000-0x0000000000DCC000-memory.dmp

Filesize
752KB

Download