4530593aa0ccd84c4c3df418e63c38b7b5d282613f2b801835b07ea4637218e5 | Triage

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220414-en
submitted
07-07-2022 16:39

Sharing

Report Analysis Logs

General

Target

4530593aa0ccd84c4c3df418e63c38b7b5d282613f2b801835b07ea4637218e5.exe
Size

72KB
MD5

aa70c9708a8e8e8534ff63e70cf0044b
SHA1

273c54758feb2c55fcb06782f27ccfd4675857fe
SHA256

4530593aa0ccd84c4c3df418e63c38b7b5d282613f2b801835b07ea4637218e5
SHA512

839e797b75414195838eade299a820bcd527575843807fccc483b456fe2504f98a2213279ddcdd2d8978cbcd9fee2297284ddb901686f81c5692e6d394790923

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

852 800 WerFault.exe 4530593aa0ccd84c4c3df418e63c38b7b5d282613f2b801835b07ea4637218e5.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

4530593aa0ccd84c4c3df418e63c38b7b5d282613f2b801835b07ea4637218e5.exe

description	pid	process	target process
PID 800 wrote to memory of 852	800	4530593aa0ccd84c4c3df418e63c38b7b5d282613f2b801835b07ea4637218e5.exe	WerFault.exe
PID 800 wrote to memory of 852	800	4530593aa0ccd84c4c3df418e63c38b7b5d282613f2b801835b07ea4637218e5.exe	WerFault.exe
PID 800 wrote to memory of 852	800	4530593aa0ccd84c4c3df418e63c38b7b5d282613f2b801835b07ea4637218e5.exe	WerFault.exe
PID 800 wrote to memory of 852	800	4530593aa0ccd84c4c3df418e63c38b7b5d282613f2b801835b07ea4637218e5.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\4530593aa0ccd84c4c3df418e63c38b7b5d282613f2b801835b07ea4637218e5.exe
"C:\Users\Admin\AppData\Local\Temp\4530593aa0ccd84c4c3df418e63c38b7b5d282613f2b801835b07ea4637218e5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 64
2⤵
- Program crash
PID:852

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/852-54-0x0000000000000000-mapping.dmp

Download