c8faec8e4990de979e3be1e29db96bc51406adf26ee07b2c33f000951a038469 | Triage

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220414-en
submitted
01-07-2022 04:34

Sharing

Report Analysis Logs

General

Target

c8faec8e4990de979e3be1e29db96bc51406adf26ee07b2c33f000951a038469.exe
Size

100KB
MD5

a39c4e63131b42c4f06fa7fb0937f4cb
SHA1

1a1d342478d986653e98fbe57baab9144c15f4bd
SHA256

c8faec8e4990de979e3be1e29db96bc51406adf26ee07b2c33f000951a038469
SHA512

8ae5191ffa56e2f312f2a06c5134e8562a7daab622a32374b203f97279c373645d1b2357d5e47542193cbdebeaf50ba31bab08141e006d3d54e9f768b3793041

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1848 1836 WerFault.exe c8faec8e4990de979e3be1e29db96bc51406adf26ee07b2c33f000951a038469.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c8faec8e4990de979e3be1e29db96bc51406adf26ee07b2c33f000951a038469.exe

description	pid	process	target process
PID 1836 wrote to memory of 1848	1836	c8faec8e4990de979e3be1e29db96bc51406adf26ee07b2c33f000951a038469.exe	WerFault.exe
PID 1836 wrote to memory of 1848	1836	c8faec8e4990de979e3be1e29db96bc51406adf26ee07b2c33f000951a038469.exe	WerFault.exe
PID 1836 wrote to memory of 1848	1836	c8faec8e4990de979e3be1e29db96bc51406adf26ee07b2c33f000951a038469.exe	WerFault.exe
PID 1836 wrote to memory of 1848	1836	c8faec8e4990de979e3be1e29db96bc51406adf26ee07b2c33f000951a038469.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\c8faec8e4990de979e3be1e29db96bc51406adf26ee07b2c33f000951a038469.exe
"C:\Users\Admin\AppData\Local\Temp\c8faec8e4990de979e3be1e29db96bc51406adf26ee07b2c33f000951a038469.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 36
2⤵
- Program crash
PID:1848

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1848-54-0x0000000000000000-mapping.dmp

Download