4c51ac11bd6f142f894d1c42fb07b3f5eff5c125e0342f4ea322ca131cecaa21 | Triage™

Analysis

max time kernel
91s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
20/06/2022, 02:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Order Form.exe
Size 2.6MB
Sample220620-dafc3seed9
SHA256 4c51ac11bd6f142f894d1c42fb07b3f5eff5c125e0342f4ea322ca131cecaa21
MD5 f7ad1a2e8f73eeed6cbab48a129b3c6e
SHA1 f198282b667cebd73ac44086438ec3af6382daa5
SHA512 747967fee8647312d1fad1967be3c843dacdb4993a3fd246b0001f9093610e0e167b6807300fd050403c6dd810e63c13c2245cc2966ca6d9d1a5f6c301ac1382
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2368	4872	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 4872	2148	regsvr32.exe	82
PID 2148 wrote to memory of 4872	2148	regsvr32.exe	82
PID 2148 wrote to memory of 4872	2148	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\Order Form.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\SysWOW64\regsvr32.exe
  /s "C:\Users\Admin\AppData\Local\Temp\Order Form.exe"
  2⤵
  PID:4872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 612
    3⤵
    - Program crash
    PID:2368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4872 -ip 4872
1⤵
PID:1876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads