3d501588937f0660988beca3ab8061d2900f437e714c21a2a953205efbe39178 | Triage

Analysis

max time kernel
26s
max time network
47s
platform
windows7_x64
resource
win7-20220414-en
submitted
08-07-2022 15:34

Sharing

Report Analysis Logs

General

Target

3d501588937f0660988beca3ab8061d2900f437e714c21a2a953205efbe39178.exe
Size

310KB
MD5

1a4b22bb1c68e4c3f80324d160afe5e7
SHA1

d216eb91f125ac3264d161b6f2ce75c61a141e2a
SHA256

3d501588937f0660988beca3ab8061d2900f437e714c21a2a953205efbe39178
SHA512

5cdb3881d2d0faada447a16c5eca65bf6c8150879d746b011da507966bb1a8fec140cd01f9103cfb223d2fa280f548cd0e74d3cf6095e55cc391b6b62c75abec

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1684 848 WerFault.exe 3d501588937f0660988beca3ab8061d2900f437e714c21a2a953205efbe39178.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

3d501588937f0660988beca3ab8061d2900f437e714c21a2a953205efbe39178.exe

description	pid	process	target process
PID 848 wrote to memory of 1684	848	3d501588937f0660988beca3ab8061d2900f437e714c21a2a953205efbe39178.exe	WerFault.exe
PID 848 wrote to memory of 1684	848	3d501588937f0660988beca3ab8061d2900f437e714c21a2a953205efbe39178.exe	WerFault.exe
PID 848 wrote to memory of 1684	848	3d501588937f0660988beca3ab8061d2900f437e714c21a2a953205efbe39178.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\3d501588937f0660988beca3ab8061d2900f437e714c21a2a953205efbe39178.exe
"C:\Users\Admin\AppData\Local\Temp\3d501588937f0660988beca3ab8061d2900f437e714c21a2a953205efbe39178.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:848

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 848 -s 36
2⤵
- Program crash
PID:1684

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1684-54-0x0000000000000000-mapping.dmp

Download