bd2709e7614b75b2748ddd1ec0f4d6e01ac99e9e3b321246e08a5149ce9027df | Triage™

Analysis

max time kernel
96s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
20/06/2022, 16:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Heur.Mint.Zard.52.1127.exe
Size 2.6MB
Sample220620-t6h2vafadn
SHA256 bd2709e7614b75b2748ddd1ec0f4d6e01ac99e9e3b321246e08a5149ce9027df
MD5 6ffbcef7b5ff3775611da1fe65f81cdc
SHA1 42e74d2a0fc4fa6dfc515d71530e0e103419a454
SHA512 f1a7bd458c527f8c3009b9261d60a16c16e47a501664c13469593a2a7bbda8fe5c5591eae24975b93ced0a9274e61ea31efb32a9e478bf1c2a93dbe7eea4270d
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4820	3284	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 3284	1252	regsvr32.exe	81
PID 1252 wrote to memory of 3284	1252	regsvr32.exe	81
PID 1252 wrote to memory of 3284	1252	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.Mint.Zard.52.1127.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.Mint.Zard.52.1127.exe
  2⤵
  PID:3284
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3284 -s 608
    3⤵
    - Program crash
    PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3284 -ip 3284
1⤵
PID:4852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads