a9ce03985ab87b07c8481da5d59db8608b2fc946df99d0ff19dc0d34d66945ee | Triage

Analysis

max time kernel
90s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
04-07-2022 09:43

Sharing

Report Analysis Logs

General

Target

17ea24ce8866da7ef4a842cba16961eafba89d526d3efe5d783bb7a30c5d1565.exe
Size

875KB
MD5

4a4521edbd840696964c15c3375975ff
SHA1

03234ca564f81757dd2334cbe60d8f5933024d09
SHA256

17ea24ce8866da7ef4a842cba16961eafba89d526d3efe5d783bb7a30c5d1565
SHA512

bc740c63b7db2bc426c18569a532b30fb4ac7393d51d4cf449c22bf97fe5f76f2790b9cf1d3b2714fc55b578ad5cae438a53431e3899fb71cfa8af9448db4a1b

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3464 3396 WerFault.exe 17ea24ce8866da7ef4a842cba16961eafba89d526d3efe5d783bb7a30c5d1565.exe

C:\Users\Admin\AppData\Local\Temp\17ea24ce8866da7ef4a842cba16961eafba89d526d3efe5d783bb7a30c5d1565.exe
"C:\Users\Admin\AppData\Local\Temp\17ea24ce8866da7ef4a842cba16961eafba89d526d3efe5d783bb7a30c5d1565.exe"
1⤵
PID:3396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 568
2⤵
- Program crash
PID:3464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3396 -ip 3396
1⤵
PID:2124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3396-130-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/3396-131-0x0000000077DD0000-0x0000000077F73000-memory.dmp

Filesize
1.6MB

Download
memory/3396-132-0x0000000077740000-0x0000000077955000-memory.dmp

Filesize
2.1MB

Download
memory/3396-134-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download