7107423b9febe648d1acabb59373aaca087884c6ae3c2e513f1f9f7ceb42d818 | Triage

Analysis

max time kernel
40s
max time network
48s
platform
windows7_x64
resource
win7-20220414-en
submitted
01-07-2022 14:20

Sharing

Report Analysis Logs

General

Target

7107423b9febe648d1acabb59373aaca087884c6ae3c2e513f1f9f7ceb42d818.exe
Size

100KB
MD5

649b5eaded192ba00d83dcb55c480050
SHA1

5d277b0c4f40a9f3e9851210e023ba8fc83bb40b
SHA256

7107423b9febe648d1acabb59373aaca087884c6ae3c2e513f1f9f7ceb42d818
SHA512

35e887c2910b7290eab4b0076a20077cc546517fc8f3ce432f5c5d27b557851a8b22b06910dadb41b78ccf55189cdb6795dabbdfda47d8d48db0a222d6651a86

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

676 1968 WerFault.exe 7107423b9febe648d1acabb59373aaca087884c6ae3c2e513f1f9f7ceb42d818.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

7107423b9febe648d1acabb59373aaca087884c6ae3c2e513f1f9f7ceb42d818.exe

description	pid	process	target process
PID 1968 wrote to memory of 676	1968	7107423b9febe648d1acabb59373aaca087884c6ae3c2e513f1f9f7ceb42d818.exe	WerFault.exe
PID 1968 wrote to memory of 676	1968	7107423b9febe648d1acabb59373aaca087884c6ae3c2e513f1f9f7ceb42d818.exe	WerFault.exe
PID 1968 wrote to memory of 676	1968	7107423b9febe648d1acabb59373aaca087884c6ae3c2e513f1f9f7ceb42d818.exe	WerFault.exe
PID 1968 wrote to memory of 676	1968	7107423b9febe648d1acabb59373aaca087884c6ae3c2e513f1f9f7ceb42d818.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\7107423b9febe648d1acabb59373aaca087884c6ae3c2e513f1f9f7ceb42d818.exe
"C:\Users\Admin\AppData\Local\Temp\7107423b9febe648d1acabb59373aaca087884c6ae3c2e513f1f9f7ceb42d818.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 36
2⤵
- Program crash
PID:676

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/676-54-0x0000000000000000-mapping.dmp

Download