7b7f7ed42df9b734e5a70444d0b3af9fc2bf56c9fd9a99bd799cbff73914809f | Triage

Analysis

max time kernel
178s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
25-06-2022 05:20

Sharing

Report Analysis Logs

General

Target

7b7f7ed42df9b734e5a70444d0b3af9fc2bf56c9fd9a99bd799cbff73914809f.exe
Size

165KB
MD5

389847caa6d7696ff4db2956f91fcbe9
SHA1

c8cadac5bc8513fe8c16b53623bd8dc5a49458fa
SHA256

7b7f7ed42df9b734e5a70444d0b3af9fc2bf56c9fd9a99bd799cbff73914809f
SHA512

58208681b24401749f37ae16c2fe060f29c729c13f7ad6a82d1ca21795a48a95170b31fa53403c071bdb661da3b14d0fb056892b8e690842dc3935f2d59bf731

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
2716	1576	WerFault.exe	7b7f7ed42df9b734e5a70444d0b3af9fc2bf56c9fd9a99bd799cbff73914809f.exe
2700	1576	WerFault.exe	7b7f7ed42df9b734e5a70444d0b3af9fc2bf56c9fd9a99bd799cbff73914809f.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

7b7f7ed42df9b734e5a70444d0b3af9fc2bf56c9fd9a99bd799cbff73914809f.exe

description	pid	process	target process
PID 1576 wrote to memory of 2700	1576	7b7f7ed42df9b734e5a70444d0b3af9fc2bf56c9fd9a99bd799cbff73914809f.exe	WerFault.exe
PID 1576 wrote to memory of 2700	1576	7b7f7ed42df9b734e5a70444d0b3af9fc2bf56c9fd9a99bd799cbff73914809f.exe	WerFault.exe
PID 1576 wrote to memory of 2700	1576	7b7f7ed42df9b734e5a70444d0b3af9fc2bf56c9fd9a99bd799cbff73914809f.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\7b7f7ed42df9b734e5a70444d0b3af9fc2bf56c9fd9a99bd799cbff73914809f.exe
"C:\Users\Admin\AppData\Local\Temp\7b7f7ed42df9b734e5a70444d0b3af9fc2bf56c9fd9a99bd799cbff73914809f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 224
2⤵
- Program crash
PID:2716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 224
2⤵
- Program crash
PID:2700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1576 -ip 1576
1⤵
PID:2532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2700-130-0x0000000000000000-mapping.dmp

Download