7b7f7ed42df9b734e5a70444d0b3af9fc2bf56c9fd9a99bd799cbff73914809f | Triage

Analysis

max time kernel
6s
max time network
48s
platform
windows7_x64
resource
win7-20220414-en
submitted
25-06-2022 05:20

Sharing

Report Analysis Logs

General

Target

7b7f7ed42df9b734e5a70444d0b3af9fc2bf56c9fd9a99bd799cbff73914809f.exe
Size

165KB
MD5

389847caa6d7696ff4db2956f91fcbe9
SHA1

c8cadac5bc8513fe8c16b53623bd8dc5a49458fa
SHA256

7b7f7ed42df9b734e5a70444d0b3af9fc2bf56c9fd9a99bd799cbff73914809f
SHA512

58208681b24401749f37ae16c2fe060f29c729c13f7ad6a82d1ca21795a48a95170b31fa53403c071bdb661da3b14d0fb056892b8e690842dc3935f2d59bf731

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1944 624 WerFault.exe 7b7f7ed42df9b734e5a70444d0b3af9fc2bf56c9fd9a99bd799cbff73914809f.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

7b7f7ed42df9b734e5a70444d0b3af9fc2bf56c9fd9a99bd799cbff73914809f.exe

description	pid	process	target process
PID 624 wrote to memory of 1944	624	7b7f7ed42df9b734e5a70444d0b3af9fc2bf56c9fd9a99bd799cbff73914809f.exe	WerFault.exe
PID 624 wrote to memory of 1944	624	7b7f7ed42df9b734e5a70444d0b3af9fc2bf56c9fd9a99bd799cbff73914809f.exe	WerFault.exe
PID 624 wrote to memory of 1944	624	7b7f7ed42df9b734e5a70444d0b3af9fc2bf56c9fd9a99bd799cbff73914809f.exe	WerFault.exe
PID 624 wrote to memory of 1944	624	7b7f7ed42df9b734e5a70444d0b3af9fc2bf56c9fd9a99bd799cbff73914809f.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\7b7f7ed42df9b734e5a70444d0b3af9fc2bf56c9fd9a99bd799cbff73914809f.exe
"C:\Users\Admin\AppData\Local\Temp\7b7f7ed42df9b734e5a70444d0b3af9fc2bf56c9fd9a99bd799cbff73914809f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 36
2⤵
- Program crash
PID:1944

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1944-54-0x0000000000000000-mapping.dmp

Download