4c51a9f2c247d7a7d027a9b5a440f7cbe1a7d85b23f5d2a803f6548e4f7100c5 | Triage

Analysis

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20220414-en
submitted
14/06/2022, 21:52

Sharing

Report Analysis Logs

General

Target

0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe
Size

1.2MB
MD5

61bca80732c3e682e00fb4bd8c48d52b
SHA1

f32a21133c750d1c26e412b305b32110d281a981
SHA256

0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f
SHA512

498efd615df973793d222bf55573499199b6c1d775b58a0c0c6eb2b94eb8234f6c263156c651e5084eede2bf6d0589500fc375c16728d32ef324be4eb354bca1

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1680	1276	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 1680	1276	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe	27
PID 1276 wrote to memory of 1680	1276	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe	27
PID 1276 wrote to memory of 1680	1276	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe	27
PID 1276 wrote to memory of 1680	1276	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe	27

C:\Users\Admin\AppData\Local\Temp\0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe
"C:\Users\Admin\AppData\Local\Temp\0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1276 -s 540
  2⤵
  - Program crash
  PID:1680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1276-54-0x0000000000390000-0x00000000004C0000-memory.dmp

Filesize
1.2MB

Download