03b9b334ff27f450f8e9b156f3693cf8b8e349754271cdceeac22ae9cd2dec8a | Triage

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220414-en
submitted
24-05-2022 14:04

Sharing

Report Analysis Logs

General

Target

4364-221-0x0000000000400000-0x00000000004A7000-memory.exe
Size

668KB
MD5

6c2bb4311a2593b52dc8fa51c4968aeb
SHA1

67b487641f125081d06db95d87cdb3e168042cd5
SHA256

03b9b334ff27f450f8e9b156f3693cf8b8e349754271cdceeac22ae9cd2dec8a
SHA512

769090d9c1e87db83e982aba3a98611a4d11caa792c6a226f5196e49ebd1d8a0a37fb0442fb5f76fb59a051e3a9c406ad30f16b49e9e6e9dd8bb6097086b3abd

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1352 1396 WerFault.exe 4364-221-0x0000000000400000-0x00000000004A7000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

4364-221-0x0000000000400000-0x00000000004A7000-memory.exe

description	pid	process	target process
PID 1396 wrote to memory of 1352	1396	4364-221-0x0000000000400000-0x00000000004A7000-memory.exe	WerFault.exe
PID 1396 wrote to memory of 1352	1396	4364-221-0x0000000000400000-0x00000000004A7000-memory.exe	WerFault.exe
PID 1396 wrote to memory of 1352	1396	4364-221-0x0000000000400000-0x00000000004A7000-memory.exe	WerFault.exe
PID 1396 wrote to memory of 1352	1396	4364-221-0x0000000000400000-0x00000000004A7000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\4364-221-0x0000000000400000-0x00000000004A7000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\4364-221-0x0000000000400000-0x00000000004A7000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 36
2⤵
- Program crash
PID:1352

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1352-54-0x0000000000000000-mapping.dmp

Download