1839619cf00da397e395b9555b6d0c9e30ac389ef48dfbbd0ddba4a083a7eb46 | Triage

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
08-06-2022 18:05

Sharing

Report Analysis Logs

General

Target

1839619cf00da397e395b9555b6d0c9e30ac389ef48dfbbd0ddba4a083a7eb46.exe
Size

1.8MB
MD5

73d9794c8e50c039182ae2707f7909f3
SHA1

556104b07b5cd018c9931b74a4f07956b84efee0
SHA256

1839619cf00da397e395b9555b6d0c9e30ac389ef48dfbbd0ddba4a083a7eb46
SHA512

6153bec770d13ec6f810cdd6ef8b0742e8de4d7263b43bc5bd19b447b2de2c51969f926af40d668dff87cf4d9a00bf1f84a3879ccb48307d6ee2454fbada4ed5

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1212	5100	WerFault.exe	81

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\	1839619cf00da397e395b9555b6d0c9e30ac389ef48dfbbd0ddba4a083a7eb46.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5100	1839619cf00da397e395b9555b6d0c9e30ac389ef48dfbbd0ddba4a083a7eb46.exe

C:\Users\Admin\AppData\Local\Temp\1839619cf00da397e395b9555b6d0c9e30ac389ef48dfbbd0ddba4a083a7eb46.exe
"C:\Users\Admin\AppData\Local\Temp\1839619cf00da397e395b9555b6d0c9e30ac389ef48dfbbd0ddba4a083a7eb46.exe"
1⤵
- NTFS ADS
- Suspicious behavior: RenamesItself
PID:5100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5100 -s 1092
  2⤵
  - Program crash
  PID:1212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5100 -ip 5100
1⤵
PID:4224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads