137ae44ea6f625a3dae762a668b68c96b10f953e5b407d3f5600da096a014f46 | Triage

Analysis

max time kernel
19s
max time network
46s
platform
windows7_x64
resource
win7-20220414-en
submitted
03-06-2022 06:03

Sharing

Report Analysis Logs

General

Target

137ae44ea6f625a3dae762a668b68c96b10f953e5b407d3f5600da096a014f46.exe
Size

108KB
MD5

0a8fdbfbffe62f5e31cb908230eed094
SHA1

a1cba447dc1e40cf7745ac7fc3c52d0cebfb3165
SHA256

137ae44ea6f625a3dae762a668b68c96b10f953e5b407d3f5600da096a014f46
SHA512

d7a41966119e48a281efa191b83c71561f6f4d4437d0e46088265b219a062d0ef1ded09c4bb5f63ab69b4ba1c7978c33b1e0040f1f38bd9835c6df019adfb165

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
1968	1700	WerFault.exe	18

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

137ae44ea6f625a3dae762a668b68c96b10f953e5b407d3f5600da096a014f46.exe

description	pid	Process	procid_target
PID 1700 wrote to memory of 1968	1700	137ae44ea6f625a3dae762a668b68c96b10f953e5b407d3f5600da096a014f46.exe	27
PID 1700 wrote to memory of 1968	1700	137ae44ea6f625a3dae762a668b68c96b10f953e5b407d3f5600da096a014f46.exe	27
PID 1700 wrote to memory of 1968	1700	137ae44ea6f625a3dae762a668b68c96b10f953e5b407d3f5600da096a014f46.exe	27
PID 1700 wrote to memory of 1968	1700	137ae44ea6f625a3dae762a668b68c96b10f953e5b407d3f5600da096a014f46.exe	27

C:\Users\Admin\AppData\Local\Temp\137ae44ea6f625a3dae762a668b68c96b10f953e5b407d3f5600da096a014f46.exe
"C:\Users\Admin\AppData\Local\Temp\137ae44ea6f625a3dae762a668b68c96b10f953e5b407d3f5600da096a014f46.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 180
  2⤵
  - Program crash
  PID:1968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1700-54-0x0000000075841000-0x0000000075843000-memory.dmp

Filesize
8KB

Download
memory/1968-55-0x0000000000000000-mapping.dmp

Download