d1ea1b02bcb1470189de830926a6ae71937ee1cee9d40d270cc9cebef0065e28 | Triage

Analysis

max time kernel
41s
max time network
44s
platform
windows7_x64
resource
win7-20220414-en
submitted
28-06-2022 14:54

Sharing

Report Analysis Logs

General

Target

Dridex_ba1c35ea63d1d791499e005f533dc2dba4f274fe95c9269dfbb3da95e66028af.exe
Size

212KB
MD5

f0f3098ba4bc288135f1fce5383903e9
SHA1

43ead8676e4cbe7e3bca8ce0f5a5ff29204bac41
SHA256

ba1c35ea63d1d791499e005f533dc2dba4f274fe95c9269dfbb3da95e66028af
SHA512

eb203ff2ed2938692bed76ac90a8ba5d6e495da98dcca925d3dc7383bd3d8fd2dd354050318b7e510fdab0646bfe9e98258c41ffd25e474a2b0181a873c7cb4a

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

900 656 WerFault.exe Dridex_ba1c35ea63d1d791499e005f533dc2dba4f274fe95c9269dfbb3da95e66028af.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Dridex_ba1c35ea63d1d791499e005f533dc2dba4f274fe95c9269dfbb3da95e66028af.exe

description	pid	process	target process
PID 656 wrote to memory of 900	656	Dridex_ba1c35ea63d1d791499e005f533dc2dba4f274fe95c9269dfbb3da95e66028af.exe	WerFault.exe
PID 656 wrote to memory of 900	656	Dridex_ba1c35ea63d1d791499e005f533dc2dba4f274fe95c9269dfbb3da95e66028af.exe	WerFault.exe
PID 656 wrote to memory of 900	656	Dridex_ba1c35ea63d1d791499e005f533dc2dba4f274fe95c9269dfbb3da95e66028af.exe	WerFault.exe
PID 656 wrote to memory of 900	656	Dridex_ba1c35ea63d1d791499e005f533dc2dba4f274fe95c9269dfbb3da95e66028af.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Dridex_ba1c35ea63d1d791499e005f533dc2dba4f274fe95c9269dfbb3da95e66028af.exe
"C:\Users\Admin\AppData\Local\Temp\Dridex_ba1c35ea63d1d791499e005f533dc2dba4f274fe95c9269dfbb3da95e66028af.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 656 -s 36
2⤵
- Program crash
PID:900

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/900-54-0x0000000000000000-mapping.dmp

Download