4c51a9f2c247d7a7d027a9b5a440f7cbe1a7d85b23f5d2a803f6548e4f7100c5 | Triage

Analysis

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20220414-en
submitted
14-06-2022 21:52

Sharing

Report Analysis Logs

General

Target

0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe
Size

1.2MB
MD5

61bca80732c3e682e00fb4bd8c48d52b
SHA1

f32a21133c750d1c26e412b305b32110d281a981
SHA256

0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f
SHA512

498efd615df973793d222bf55573499199b6c1d775b58a0c0c6eb2b94eb8234f6c263156c651e5084eede2bf6d0589500fc375c16728d32ef324be4eb354bca1

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1680 1276 WerFault.exe 0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe

description	pid	process	target process
PID 1276 wrote to memory of 1680	1276	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe	WerFault.exe
PID 1276 wrote to memory of 1680	1276	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe	WerFault.exe
PID 1276 wrote to memory of 1680	1276	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe	WerFault.exe
PID 1276 wrote to memory of 1680	1276	0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe
"C:\Users\Admin\AppData\Local\Temp\0e99aef5608c3357e1425734aad75eaff3d241c1676d5af60cd3c9c43dd1441f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1276 -s 540
2⤵
- Program crash
PID:1680

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1276-54-0x0000000000390000-0x00000000004C0000-memory.dmp

Filesize
1.2MB

Download
memory/1680-55-0x0000000000000000-mapping.dmp

Download