42a568aace998ff83db4d410215e6a8ab89c52a0faaa58d7c73841323656b631 | Triage

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220414-en
submitted
04-07-2022 07:16

Sharing

Report Analysis Logs

General

Target

order.pdf.exe
Size

1.3MB
MD5

0359845b6b55a743773b5d6029761eab
SHA1

6266bc38a7e9339e829c0a8f15781c0501ce11f5
SHA256

f5c4d614b9bc10a5dc4c06f087d591d6bd238a101c485d1612da596c34f74a89
SHA512

ae4c2f3c2978872aabf88e61c2d07fd805b0fa962b166a0b301cd53f77ac30c192becb7a3836bead6fc7237f689437b66c420ebc6f9b8e294d697e6c3cedffda

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1120 1928 WerFault.exe regsvr32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 1948 wrote to memory of 1928	1948	regsvr32.exe	regsvr32.exe
PID 1948 wrote to memory of 1928	1948	regsvr32.exe	regsvr32.exe
PID 1948 wrote to memory of 1928	1948	regsvr32.exe	regsvr32.exe
PID 1948 wrote to memory of 1928	1948	regsvr32.exe	regsvr32.exe
PID 1948 wrote to memory of 1928	1948	regsvr32.exe	regsvr32.exe
PID 1948 wrote to memory of 1928	1948	regsvr32.exe	regsvr32.exe
PID 1948 wrote to memory of 1928	1948	regsvr32.exe	regsvr32.exe
PID 1928 wrote to memory of 1120	1928	regsvr32.exe	WerFault.exe
PID 1928 wrote to memory of 1120	1928	regsvr32.exe	WerFault.exe
PID 1928 wrote to memory of 1120	1928	regsvr32.exe	WerFault.exe
PID 1928 wrote to memory of 1120	1928	regsvr32.exe	WerFault.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\order.pdf.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1948

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\order.pdf.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 296
3⤵
- Program crash
PID:1120

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1120-57-0x0000000000000000-mapping.dmp

Download
memory/1928-55-0x0000000000000000-mapping.dmp

Download
memory/1928-56-0x0000000076721000-0x0000000076723000-memory.dmp

Filesize
8KB

Download
memory/1948-54-0x000007FEFBF21000-0x000007FEFBF23000-memory.dmp

Filesize
8KB

Download