305153b14416391a42cd06338729048cc5a4163bb3a014422745beb5e6572811 | Triage

Analysis

max time kernel
93s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
21-06-2022 04:31

Sharing

Report Analysis Logs

General

Target

305153b14416391a42cd06338729048cc5a4163bb3a014422745beb5e6572811.exe
Size

357KB
MD5

31e4d13c5d776036ac3603565ddc4db3
SHA1

6e8aa64ca4daec8e3e97c74c442c6e4c8143a63b
SHA256

305153b14416391a42cd06338729048cc5a4163bb3a014422745beb5e6572811
SHA512

3ecd27df132d599d7f16268c8501a71330a33d1e0b94fd340629db54d8fc2f09736ae2b86d9570b198bc5969973ef19feabf3980a21ab394eec99c0ed6e32d9e

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4388 2160 WerFault.exe 305153b14416391a42cd06338729048cc5a4163bb3a014422745beb5e6572811.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

305153b14416391a42cd06338729048cc5a4163bb3a014422745beb5e6572811.exe

pid process

2160 305153b14416391a42cd06338729048cc5a4163bb3a014422745beb5e6572811.exe

C:\Users\Admin\AppData\Local\Temp\305153b14416391a42cd06338729048cc5a4163bb3a014422745beb5e6572811.exe
"C:\Users\Admin\AppData\Local\Temp\305153b14416391a42cd06338729048cc5a4163bb3a014422745beb5e6572811.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:2160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 832
2⤵
- Program crash
PID:4388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2160 -ip 2160
1⤵
PID:1112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...