e6b5420e96f75cbc41decc0108c277b71e456a55e5fe750c966a44b5c66473d0 | Triage

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220414-en
submitted
01-07-2022 10:46

Sharing

Report Analysis Logs

General

Target

DHLReceipt10106272873.exe
Size

645KB
MD5

890f2ae36a16e223d45f0351f8369174
SHA1

2062f503376626148862920802be1b33bdd0fcdd
SHA256

e6b5420e96f75cbc41decc0108c277b71e456a55e5fe750c966a44b5c66473d0
SHA512

56903a51003e33694d3b47b95ddd8603fac77890ccc11f9b8747f208cf2558f4fc4467f399b2dc158af1605bb806f7ecb64b04bf4105ae79f89d89d36f82afd3

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

944 1532 WerFault.exe DHLReceipt10106272873.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

DHLReceipt10106272873.exe

description	pid	process	target process
PID 1532 wrote to memory of 944	1532	DHLReceipt10106272873.exe	WerFault.exe
PID 1532 wrote to memory of 944	1532	DHLReceipt10106272873.exe	WerFault.exe
PID 1532 wrote to memory of 944	1532	DHLReceipt10106272873.exe	WerFault.exe
PID 1532 wrote to memory of 944	1532	DHLReceipt10106272873.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\DHLReceipt10106272873.exe
"C:\Users\Admin\AppData\Local\Temp\DHLReceipt10106272873.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 588
  2⤵
  - Program crash
  PID:944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/944-56-0x0000000000000000-mapping.dmp

Download
memory/1532-54-0x0000000001330000-0x00000000013D8000-memory.dmp

Filesize
672KB

Download
memory/1532-55-0x0000000000A40000-0x0000000000AAA000-memory.dmp

Filesize
424KB

Download