d5254a2d8ee7e611ae4ddb0cd0a6ae791a352ce0e9cf47432af64ab62b8b949b | Triage

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220414-en
submitted
01-07-2022 05:58

Sharing

Report Analysis Logs

General

Target

d5254a2d8ee7e611ae4ddb0cd0a6ae791a352ce0e9cf47432af64ab62b8b949b.exe
Size

100KB
MD5

4a2fb0f697d63ccd36fc9bf32aa387f0
SHA1

6ced80a22e76a3401559786394d62212f80b92c9
SHA256

d5254a2d8ee7e611ae4ddb0cd0a6ae791a352ce0e9cf47432af64ab62b8b949b
SHA512

4a6ee681d966b9820471204a89960ea003f51eeeb968dc098e6d29f123deaa3922fec5cd6f654b9cef9a8ffed60d00b1e47312eaf248d059261bb3100820af19

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

616 1764 WerFault.exe d5254a2d8ee7e611ae4ddb0cd0a6ae791a352ce0e9cf47432af64ab62b8b949b.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

d5254a2d8ee7e611ae4ddb0cd0a6ae791a352ce0e9cf47432af64ab62b8b949b.exe

description	pid	process	target process
PID 1764 wrote to memory of 616	1764	d5254a2d8ee7e611ae4ddb0cd0a6ae791a352ce0e9cf47432af64ab62b8b949b.exe	WerFault.exe
PID 1764 wrote to memory of 616	1764	d5254a2d8ee7e611ae4ddb0cd0a6ae791a352ce0e9cf47432af64ab62b8b949b.exe	WerFault.exe
PID 1764 wrote to memory of 616	1764	d5254a2d8ee7e611ae4ddb0cd0a6ae791a352ce0e9cf47432af64ab62b8b949b.exe	WerFault.exe
PID 1764 wrote to memory of 616	1764	d5254a2d8ee7e611ae4ddb0cd0a6ae791a352ce0e9cf47432af64ab62b8b949b.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\d5254a2d8ee7e611ae4ddb0cd0a6ae791a352ce0e9cf47432af64ab62b8b949b.exe
"C:\Users\Admin\AppData\Local\Temp\d5254a2d8ee7e611ae4ddb0cd0a6ae791a352ce0e9cf47432af64ab62b8b949b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 36
2⤵
- Program crash
PID:616

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/616-54-0x0000000000000000-mapping.dmp

Download