fe29566569ad2dc80058ea8eb409b1e43a108edbb92226981d63fbfb3723dbcd | Triage

Analysis

max time kernel
41s
max time network
44s
platform
windows7_x64
resource
win7-20220414-en
submitted
21-05-2022 06:17

Sharing

Report Analysis Logs

General

Target

Required Order Details 00102.exe
Size

1.0MB
MD5

6d0179f9aa38d8a3e647515c7877e0cf
SHA1

a6d06468daa02b19af4e6cfcd42faa2da8758539
SHA256

fe29566569ad2dc80058ea8eb409b1e43a108edbb92226981d63fbfb3723dbcd
SHA512

ba7fdce604ba075f1c476107febddee83f6a0b6334a026e9a8b08fe85e07dce8ab542a301f079b20667ea8f547229768cc1fb5fa3f683c1b5847837ee1c1caff

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1668 1852 WerFault.exe Required Order Details 00102.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Required Order Details 00102.exe

description	pid	process	target process
PID 1852 wrote to memory of 1668	1852	Required Order Details 00102.exe	WerFault.exe
PID 1852 wrote to memory of 1668	1852	Required Order Details 00102.exe	WerFault.exe
PID 1852 wrote to memory of 1668	1852	Required Order Details 00102.exe	WerFault.exe
PID 1852 wrote to memory of 1668	1852	Required Order Details 00102.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Required Order Details 00102.exe
"C:\Users\Admin\AppData\Local\Temp\Required Order Details 00102.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 556
  2⤵
  - Program crash
  PID:1668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1668-55-0x0000000000000000-mapping.dmp

Download
memory/1852-54-0x0000000000FA0000-0x00000000010A8000-memory.dmp

Filesize
1.0MB

Download