b018d689d866fd3fb05684da7b77ed41011b0d884ff6a4cb91eb4e9b0adbe4da | Triage

Analysis

max time kernel
91s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
04-07-2022 08:47

Sharing

Report Analysis Logs

General

Target

1648-68-0x0000000000400000-0x00000000004A2000-memory.exe
Size

648KB
MD5

380019ac3710344ba1f570bc48ec08bf
SHA1

c275db6ca9147d67b84a706761dd0c99d5313e09
SHA256

b018d689d866fd3fb05684da7b77ed41011b0d884ff6a4cb91eb4e9b0adbe4da
SHA512

ec1c81a5d7adc52bf6084523570a0699c5d7f96e97d5c7051501767cbdc39f0792df35a95a48bf58f08d05b92260843ed76a307e286fd59b23af01fb54d216d1

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4644 1396 WerFault.exe 1648-68-0x0000000000400000-0x00000000004A2000-memory.exe

C:\Users\Admin\AppData\Local\Temp\1648-68-0x0000000000400000-0x00000000004A2000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1648-68-0x0000000000400000-0x00000000004A2000-memory.exe"
1⤵
PID:1396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 216
2⤵
- Program crash
PID:4644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1396 -ip 1396
1⤵
PID:4976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...