5897858ea935658dd34bc4ef2692d4694eea6be164a9d8566b55c769dae2c8bc | Triage

Analysis

max time kernel
38s
max time network
45s
platform
windows7_x64
resource
win7-20220414-en
submitted
22-06-2022 08:51

Sharing

Report Analysis Logs

General

Target

52da53b1c61bf409b32f845f3806479a.exe
Size

1.6MB
MD5

52da53b1c61bf409b32f845f3806479a
SHA1

4e4120c159b2ff506c8719332dc38298ac092659
SHA256

5897858ea935658dd34bc4ef2692d4694eea6be164a9d8566b55c769dae2c8bc
SHA512

3a1ffa7db0f5b90deccbf9f84033e19ed43f9d28006f40c2c8d1cbe7c337f6fd458c966bef0b29c8f1cde725d1e1abfecb65c00b5ae6f908dcb33ecb83c7dbca

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

240 1640 WerFault.exe 52da53b1c61bf409b32f845f3806479a.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

52da53b1c61bf409b32f845f3806479a.exe

description	pid	process	target process
PID 1640 wrote to memory of 240	1640	52da53b1c61bf409b32f845f3806479a.exe	WerFault.exe
PID 1640 wrote to memory of 240	1640	52da53b1c61bf409b32f845f3806479a.exe	WerFault.exe
PID 1640 wrote to memory of 240	1640	52da53b1c61bf409b32f845f3806479a.exe	WerFault.exe
PID 1640 wrote to memory of 240	1640	52da53b1c61bf409b32f845f3806479a.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\52da53b1c61bf409b32f845f3806479a.exe
"C:\Users\Admin\AppData\Local\Temp\52da53b1c61bf409b32f845f3806479a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 584
2⤵
- Program crash
PID:240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/240-56-0x0000000000000000-mapping.dmp

Download
memory/1640-54-0x0000000000DB0000-0x0000000000F52000-memory.dmp

Filesize
1.6MB

Download
memory/1640-55-0x0000000000AE0000-0x0000000000B5C000-memory.dmp

Filesize
496KB

Download