c24aa19572a17632264c0af58695bea6a3fc8d0dccd12ba89f21dc481723b348 | Triage

Analysis

max time kernel
41s
max time network
44s
platform
windows7_x64
resource
win7-20220414-en
submitted
01-07-2022 17:03

Sharing

Report Analysis Logs

General

Target

DHL_Receipt10106272873______________________________________________________________________________.exe
Size

1.1MB
MD5

2f53deb379502fecd2a81113ffd835a6
SHA1

e160179ad42c2fad460b7b75070fa575672aff58
SHA256

c24aa19572a17632264c0af58695bea6a3fc8d0dccd12ba89f21dc481723b348
SHA512

11d6e0185131f4e9fd6952ad35077f7f6b2a29ed65372b552b5a86961204468f0c14cad083e549f5481ecb8d91f938db52ab43a7bb6d44cf2f2f3e1b922892d6

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	process	target process
2044	1688	WerFault.exe	DHL_Receipt10106272873______________________________________________________________________________.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

DHL_Receipt10106272873______________________________________________________________________________.exe

description	pid	process	target process
PID 1688 wrote to memory of 2044	1688	DHL_Receipt10106272873______________________________________________________________________________.exe	WerFault.exe
PID 1688 wrote to memory of 2044	1688	DHL_Receipt10106272873______________________________________________________________________________.exe	WerFault.exe
PID 1688 wrote to memory of 2044	1688	DHL_Receipt10106272873______________________________________________________________________________.exe	WerFault.exe
PID 1688 wrote to memory of 2044	1688	DHL_Receipt10106272873______________________________________________________________________________.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\DHL_Receipt10106272873______________________________________________________________________________.exe
"C:\Users\Admin\AppData\Local\Temp\DHL_Receipt10106272873______________________________________________________________________________.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 588
2⤵
- Program crash
PID:2044

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1688-54-0x0000000000DE0000-0x0000000000EF4000-memory.dmp

Filesize
1.1MB

Download
memory/1688-55-0x0000000000390000-0x00000000003FA000-memory.dmp

Filesize
424KB

Download
memory/2044-56-0x0000000000000000-mapping.dmp

Download