fca9d17a4c155002ad8ebcf981a85a24772565cada13b2149331da08009f1dfe | Triage

Analysis

max time kernel
36s
max time network
41s
platform
windows7_x64
resource
win7-20220414-en
submitted
24-05-2022 19:56

Sharing

Report Analysis Logs

General

Target

960-56-0x0000000000090000-0x00000000000E3000-memory.exe
Size

332KB
MD5

7bfdc39c5b9f48fdf67c7b7136a19db8
SHA1

c39f8a0a990ceed159cf33c80fb5f5bef1abd94a
SHA256

fca9d17a4c155002ad8ebcf981a85a24772565cada13b2149331da08009f1dfe
SHA512

49c7215ac9fb96af1df4d4f59356c55aacb62f05ce86d7abd7354599c0cb73caae25d102fb67a30996e230d1bca0336070e65115152f49bb08bc5fa062fc274c

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1276 1860 WerFault.exe 960-56-0x0000000000090000-0x00000000000E3000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

960-56-0x0000000000090000-0x00000000000E3000-memory.exe

description	pid	process	target process
PID 1860 wrote to memory of 1276	1860	960-56-0x0000000000090000-0x00000000000E3000-memory.exe	WerFault.exe
PID 1860 wrote to memory of 1276	1860	960-56-0x0000000000090000-0x00000000000E3000-memory.exe	WerFault.exe
PID 1860 wrote to memory of 1276	1860	960-56-0x0000000000090000-0x00000000000E3000-memory.exe	WerFault.exe
PID 1860 wrote to memory of 1276	1860	960-56-0x0000000000090000-0x00000000000E3000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\960-56-0x0000000000090000-0x00000000000E3000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\960-56-0x0000000000090000-0x00000000000E3000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 36
2⤵
- Program crash
PID:1276

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1276-54-0x0000000000000000-mapping.dmp

Download