07a2e5f21264d00977be94980f6fa46c0e955b7cf312092634a2d3f1bbd3c39e | Triage

Analysis

max time kernel
8s
max time network
48s
platform
windows7_x64
resource
win7-20220414-en
submitted
31-05-2022 01:13

Sharing

Report Analysis Logs

General

Target

07a2e5f21264d00977be94980f6fa46c0e955b7cf312092634a2d3f1bbd3c39e.exe
Size

164KB
MD5

01301b7e7aea87b2d23495498e67c58c
SHA1

bdab9012d9beace67af9ba590764f0ea8ddda4ff
SHA256

07a2e5f21264d00977be94980f6fa46c0e955b7cf312092634a2d3f1bbd3c39e
SHA512

cfc22be78cc207523019cf917b03b75f9346c1c408c0d2a2f6b18a89f0ad83757e638b44024638c9bcbf8d1b6b2df0aa899826d49e81bfe14e74f0a247eef477

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1464 1628 WerFault.exe 07a2e5f21264d00977be94980f6fa46c0e955b7cf312092634a2d3f1bbd3c39e.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

07a2e5f21264d00977be94980f6fa46c0e955b7cf312092634a2d3f1bbd3c39e.exe

description	pid	process	target process
PID 1628 wrote to memory of 1464	1628	07a2e5f21264d00977be94980f6fa46c0e955b7cf312092634a2d3f1bbd3c39e.exe	WerFault.exe
PID 1628 wrote to memory of 1464	1628	07a2e5f21264d00977be94980f6fa46c0e955b7cf312092634a2d3f1bbd3c39e.exe	WerFault.exe
PID 1628 wrote to memory of 1464	1628	07a2e5f21264d00977be94980f6fa46c0e955b7cf312092634a2d3f1bbd3c39e.exe	WerFault.exe
PID 1628 wrote to memory of 1464	1628	07a2e5f21264d00977be94980f6fa46c0e955b7cf312092634a2d3f1bbd3c39e.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\07a2e5f21264d00977be94980f6fa46c0e955b7cf312092634a2d3f1bbd3c39e.exe
"C:\Users\Admin\AppData\Local\Temp\07a2e5f21264d00977be94980f6fa46c0e955b7cf312092634a2d3f1bbd3c39e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 36
2⤵
- Program crash
PID:1464

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1464-54-0x0000000000000000-mapping.dmp

Download