483736551cd9749b6aee08234815b1c4443ec1ba1b0066e24f377c192a2dac94 | Triage

Analysis

max time kernel
13s
max time network
48s
platform
windows7_x64
resource
win7-20220414-en
submitted
25-06-2022 06:25

Sharing

Report Analysis Logs

General

Target

483736551cd9749b6aee08234815b1c4443ec1ba1b0066e24f377c192a2dac94.exe
Size

181KB
MD5

a39ff196c2185d099af2abf3d6bf0ab2
SHA1

8e4106195d6066207522d77aef9c1e40ad825690
SHA256

483736551cd9749b6aee08234815b1c4443ec1ba1b0066e24f377c192a2dac94
SHA512

64e937da94c01e18a641264166fa9a7f2f05366450376507af4f0e1bea5f7aeb8a62cecb2893c0418541c62a0e35be4dd41bee838c176819bed9bc7625190aa0

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1196 1996 WerFault.exe 483736551cd9749b6aee08234815b1c4443ec1ba1b0066e24f377c192a2dac94.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

483736551cd9749b6aee08234815b1c4443ec1ba1b0066e24f377c192a2dac94.exe

description	pid	process	target process
PID 1996 wrote to memory of 1196	1996	483736551cd9749b6aee08234815b1c4443ec1ba1b0066e24f377c192a2dac94.exe	WerFault.exe
PID 1996 wrote to memory of 1196	1996	483736551cd9749b6aee08234815b1c4443ec1ba1b0066e24f377c192a2dac94.exe	WerFault.exe
PID 1996 wrote to memory of 1196	1996	483736551cd9749b6aee08234815b1c4443ec1ba1b0066e24f377c192a2dac94.exe	WerFault.exe
PID 1996 wrote to memory of 1196	1996	483736551cd9749b6aee08234815b1c4443ec1ba1b0066e24f377c192a2dac94.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\483736551cd9749b6aee08234815b1c4443ec1ba1b0066e24f377c192a2dac94.exe
"C:\Users\Admin\AppData\Local\Temp\483736551cd9749b6aee08234815b1c4443ec1ba1b0066e24f377c192a2dac94.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 48
2⤵
- Program crash
PID:1196

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1196-54-0x0000000000000000-mapping.dmp

Download