4c51ac11bd6f142f894d1c42fb07b3f5eff5c125e0342f4ea322ca131cecaa21 | Triage™

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220414-en
submitted
20/06/2022, 02:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Order Form.exe
Size 2.6MB
Sample220620-dafc3seed9
SHA256 4c51ac11bd6f142f894d1c42fb07b3f5eff5c125e0342f4ea322ca131cecaa21
MD5 f7ad1a2e8f73eeed6cbab48a129b3c6e
SHA1 f198282b667cebd73ac44086438ec3af6382daa5
SHA512 747967fee8647312d1fad1967be3c843dacdb4993a3fd246b0001f9093610e0e167b6807300fd050403c6dd810e63c13c2245cc2966ca6d9d1a5f6c301ac1382
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2024	1212	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1212	2020	regsvr32.exe	28
PID 2020 wrote to memory of 1212	2020	regsvr32.exe	28
PID 2020 wrote to memory of 1212	2020	regsvr32.exe	28
PID 2020 wrote to memory of 1212	2020	regsvr32.exe	28
PID 2020 wrote to memory of 1212	2020	regsvr32.exe	28
PID 2020 wrote to memory of 1212	2020	regsvr32.exe	28
PID 2020 wrote to memory of 1212	2020	regsvr32.exe	28
PID 1212 wrote to memory of 2024	1212	regsvr32.exe	29
PID 1212 wrote to memory of 2024	1212	regsvr32.exe	29
PID 1212 wrote to memory of 2024	1212	regsvr32.exe	29
PID 1212 wrote to memory of 2024	1212	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\Order Form.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\regsvr32.exe
  /s "C:\Users\Admin\AppData\Local\Temp\Order Form.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1212
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 296
    3⤵
    - Program crash
    PID:2024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1212-56-0x00000000755C1000-0x00000000755C3000-memory.dmp

Download

memory/2020-54-0x000007FEFBCB1000-0x000007FEFBCB3000-memory.dmp

Download