0a95cea2b802f87bea44152ec4cc0a2635d5c97bb419a4742420b1f9b5d13fbd | Triage

Analysis

max time kernel
43s
max time network
49s
platform
windows7_x64
resource
win7-20220414-en
submitted
30-05-2022 14:50

Sharing

Report Analysis Logs

General

Target

0a95cea2b802f87bea44152ec4cc0a2635d5c97bb419a4742420b1f9b5d13fbd.exe
Size

556KB
MD5

7448083f6dc37c6e62306659a07809db
SHA1

47772da494cfbcf9f149c0974495625e0c69a85a
SHA256

0a95cea2b802f87bea44152ec4cc0a2635d5c97bb419a4742420b1f9b5d13fbd
SHA512

429d31f9f0944b1e47e4cf3025392eabd35d956ccf274381c170b84f6f20a1f7ca74910a2e2ac190bd78c28616af7f5bb24f4dc4ae7aa1a298e33725d3e699bd

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1632 1808 WerFault.exe 0a95cea2b802f87bea44152ec4cc0a2635d5c97bb419a4742420b1f9b5d13fbd.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0a95cea2b802f87bea44152ec4cc0a2635d5c97bb419a4742420b1f9b5d13fbd.exe

description	pid	process	target process
PID 1808 wrote to memory of 1632	1808	0a95cea2b802f87bea44152ec4cc0a2635d5c97bb419a4742420b1f9b5d13fbd.exe	WerFault.exe
PID 1808 wrote to memory of 1632	1808	0a95cea2b802f87bea44152ec4cc0a2635d5c97bb419a4742420b1f9b5d13fbd.exe	WerFault.exe
PID 1808 wrote to memory of 1632	1808	0a95cea2b802f87bea44152ec4cc0a2635d5c97bb419a4742420b1f9b5d13fbd.exe	WerFault.exe
PID 1808 wrote to memory of 1632	1808	0a95cea2b802f87bea44152ec4cc0a2635d5c97bb419a4742420b1f9b5d13fbd.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\0a95cea2b802f87bea44152ec4cc0a2635d5c97bb419a4742420b1f9b5d13fbd.exe
"C:\Users\Admin\AppData\Local\Temp\0a95cea2b802f87bea44152ec4cc0a2635d5c97bb419a4742420b1f9b5d13fbd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 156
2⤵
- Program crash
PID:1632

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1632-55-0x0000000000000000-mapping.dmp

Download
memory/1808-54-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

Filesize
8KB

Download