42a568aace998ff83db4d410215e6a8ab89c52a0faaa58d7c73841323656b631 | Triage

Analysis

max time kernel
112s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
04-07-2022 07:16

Sharing

Report Analysis Logs

General

Target

order.pdf.exe
Size

1.3MB
MD5

0359845b6b55a743773b5d6029761eab
SHA1

6266bc38a7e9339e829c0a8f15781c0501ce11f5
SHA256

f5c4d614b9bc10a5dc4c06f087d591d6bd238a101c485d1612da596c34f74a89
SHA512

ae4c2f3c2978872aabf88e61c2d07fd805b0fa962b166a0b301cd53f77ac30c192becb7a3836bead6fc7237f689437b66c420ebc6f9b8e294d697e6c3cedffda

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4760 4904 WerFault.exe regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3032 wrote to memory of 4904	3032	regsvr32.exe	regsvr32.exe
PID 3032 wrote to memory of 4904	3032	regsvr32.exe	regsvr32.exe
PID 3032 wrote to memory of 4904	3032	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\order.pdf.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:3032

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\order.pdf.exe
2⤵
PID:4904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 600
3⤵
- Program crash
PID:4760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4904 -ip 4904
1⤵
PID:4984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4904-130-0x0000000000000000-mapping.dmp

Download