52fe19cf1fd62bf14e93b6047ab9a4caa7d4874b0775b2b999829476ccfaacef | Triage

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220414-en
submitted
05-07-2022 17:11

Sharing

Report Analysis Logs

General

Target

Invoice.exe
Size

863KB
MD5

c2720ce6cc0f31551a6cef74c8dfc79e
SHA1

d12f85204042be1a50dc6d876dfd603a00baf0bc
SHA256

52fe19cf1fd62bf14e93b6047ab9a4caa7d4874b0775b2b999829476ccfaacef
SHA512

b15474ba548d4c1e180590291f45a7bc73832ebb392a3a837b32df0acf008e093cb9dc62fea3912c1d25d9c8460015cbd1379370ed34cd84d1f4e7d21bb167bd

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

968 1052 WerFault.exe Invoice.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Invoice.exe

description	pid	process	target process
PID 1052 wrote to memory of 968	1052	Invoice.exe	WerFault.exe
PID 1052 wrote to memory of 968	1052	Invoice.exe	WerFault.exe
PID 1052 wrote to memory of 968	1052	Invoice.exe	WerFault.exe
PID 1052 wrote to memory of 968	1052	Invoice.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Invoice.exe
"C:\Users\Admin\AppData\Local\Temp\Invoice.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 668
2⤵
- Program crash
PID:968

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/968-57-0x0000000000000000-mapping.dmp

Download
memory/1052-54-0x00000000002C0000-0x000000000039C000-memory.dmp

Filesize
880KB

Download
memory/1052-55-0x0000000076C81000-0x0000000076C83000-memory.dmp

Filesize
8KB

Download
memory/1052-56-0x00000000046B0000-0x0000000004734000-memory.dmp

Filesize
528KB

Download