3f0841eff18ab98e2614071d89619c1fb84e653cb1c524384801bdf00d7e9d42 | Triage

Analysis

max time kernel
9s
max time network
47s
platform
windows7_x64
resource
win7-20220414-en
submitted
03-06-2022 02:20

Sharing

Report Analysis Logs

General

Target

f3b2c0e21faa2d771b315cfda97a4c32.exe
Size

2.5MB
MD5

f3b2c0e21faa2d771b315cfda97a4c32
SHA1

806b920c7c0299ffa9fbe4c94825d0313381927f
SHA256

3f0841eff18ab98e2614071d89619c1fb84e653cb1c524384801bdf00d7e9d42
SHA512

6c0503c9523027ebc2c4363e2d3aef39c513316aaf69bdf5f660112a1f3f1371ca20d5f8f134485ee573076084592ace1bc5e1056c8d645e010bb6b2267b19b2

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1948 1740 WerFault.exe f3b2c0e21faa2d771b315cfda97a4c32.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

f3b2c0e21faa2d771b315cfda97a4c32.exe

description	pid	process	target process
PID 1740 wrote to memory of 1948	1740	f3b2c0e21faa2d771b315cfda97a4c32.exe	WerFault.exe
PID 1740 wrote to memory of 1948	1740	f3b2c0e21faa2d771b315cfda97a4c32.exe	WerFault.exe
PID 1740 wrote to memory of 1948	1740	f3b2c0e21faa2d771b315cfda97a4c32.exe	WerFault.exe
PID 1740 wrote to memory of 1948	1740	f3b2c0e21faa2d771b315cfda97a4c32.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\f3b2c0e21faa2d771b315cfda97a4c32.exe
"C:\Users\Admin\AppData\Local\Temp\f3b2c0e21faa2d771b315cfda97a4c32.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 252
2⤵
- Program crash
PID:1948

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1740-55-0x00000000004B0000-0x00000000007BD000-memory.dmp

Filesize
3.1MB

Download
memory/1740-56-0x0000000000150000-0x0000000000154000-memory.dmp

Filesize
16KB

Download
memory/1740-54-0x0000000000FF0000-0x0000000001421000-memory.dmp

Filesize
4.2MB

Download
memory/1948-57-0x0000000000000000-mapping.dmp

Download