c845def63370adf487ae8532a62b39858c6ae05dd7f75f8666a89e4d3f333b6f | Triage

Analysis

max time kernel
34s
max time network
46s
platform
windows7_x64
resource
win7-20220414-en
submitted
01-07-2022 04:50

Sharing

Report Analysis Logs

General

Target

c845def63370adf487ae8532a62b39858c6ae05dd7f75f8666a89e4d3f333b6f.exe
Size

100KB
MD5

1a884dafb3a280a3ac4330209edf5c90
SHA1

fbf92d513537f6e42aff20606fd03f3e73a0d25e
SHA256

c845def63370adf487ae8532a62b39858c6ae05dd7f75f8666a89e4d3f333b6f
SHA512

45030292d1a5b7c73fbac77e80ac25e0e8faffa6d25f71d4c67e8c87ca9a6702705164771f3a7fe26737216a06cd7d66cab3635595b6f72243e9858c932482e4

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1284 1212 WerFault.exe c845def63370adf487ae8532a62b39858c6ae05dd7f75f8666a89e4d3f333b6f.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c845def63370adf487ae8532a62b39858c6ae05dd7f75f8666a89e4d3f333b6f.exe

description	pid	process	target process
PID 1212 wrote to memory of 1284	1212	c845def63370adf487ae8532a62b39858c6ae05dd7f75f8666a89e4d3f333b6f.exe	WerFault.exe
PID 1212 wrote to memory of 1284	1212	c845def63370adf487ae8532a62b39858c6ae05dd7f75f8666a89e4d3f333b6f.exe	WerFault.exe
PID 1212 wrote to memory of 1284	1212	c845def63370adf487ae8532a62b39858c6ae05dd7f75f8666a89e4d3f333b6f.exe	WerFault.exe
PID 1212 wrote to memory of 1284	1212	c845def63370adf487ae8532a62b39858c6ae05dd7f75f8666a89e4d3f333b6f.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\c845def63370adf487ae8532a62b39858c6ae05dd7f75f8666a89e4d3f333b6f.exe
"C:\Users\Admin\AppData\Local\Temp\c845def63370adf487ae8532a62b39858c6ae05dd7f75f8666a89e4d3f333b6f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 36
2⤵
- Program crash
PID:1284

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1284-54-0x0000000000000000-mapping.dmp

Download