9d2aeb602bc3f0bc7b42932f1cd2f511f7c17a107049da2f0a8a563f60c60124 | Triage™

Analysis

max time kernel
90s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
20/06/2022, 09:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New_.exe
Size 2.6MB
Sample220620-k7cf1sbgfl
SHA256 9d2aeb602bc3f0bc7b42932f1cd2f511f7c17a107049da2f0a8a563f60c60124
MD5 c05194a34faeb51eea77515249534d10
SHA1 d24a2549c3bbb23e6b8899831be4d9e9b44c496b
SHA512 fce62a1ce62c37b9f776daf1b0e0629330d53dc75a3a47d9c277fa9ec5af91ff82e1e34398678ec68c7cef44a7380c77878a775a83f9e35b1b1561c2f0ba8d72
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4500	4320	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 4320	4116	regsvr32.exe	80
PID 4116 wrote to memory of 4320	4116	regsvr32.exe	80
PID 4116 wrote to memory of 4320	4116	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\New_.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\New_.exe
  2⤵
  PID:4320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 600
    3⤵
    - Program crash
    PID:4500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4320 -ip 4320
1⤵
PID:4252

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads