23dc4073b05d98b142affc92756b889207dc77974bae93950779f58dabadddbc | Triage™

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220414-en
submitted
23/06/2022, 13:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
42ad1449eb2bb9430f66767560fe2e31.exe
Size 681KB
Sample220623-q5s9msgac3
SHA256 23dc4073b05d98b142affc92756b889207dc77974bae93950779f58dabadddbc
MD5 42ad1449eb2bb9430f66767560fe2e31
SHA1 c48fb3594302f65592d2de4c387aadac5063c644
SHA512 59695a0108fbde472ac67370e446cd337846a3acd87b5dfe04358c755078d1d724aedd6cc25957b99194f1acba0bc704f284fea5e5550bb7d56eac9f4116ff22
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
836	960	WerFault.exe	25

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 836	960	42ad1449eb2bb9430f66767560fe2e31.exe	26
PID 960 wrote to memory of 836	960	42ad1449eb2bb9430f66767560fe2e31.exe	26
PID 960 wrote to memory of 836	960	42ad1449eb2bb9430f66767560fe2e31.exe	26
PID 960 wrote to memory of 836	960	42ad1449eb2bb9430f66767560fe2e31.exe	26

C:\Users\Admin\AppData\Local\Temp\42ad1449eb2bb9430f66767560fe2e31.exe
"C:\Users\Admin\AppData\Local\Temp\42ad1449eb2bb9430f66767560fe2e31.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 960 -s 628
  2⤵
  - Program crash
  PID:836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/960-54-0x0000000001360000-0x0000000001410000-memory.dmp

Download

memory/960-55-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

Download