6db136f2044fcbb7b9a15f63c6969639b7637c4a47ffb5ae3d1522489412b9d4 | Triage

Analysis

max time kernel
37s
max time network
48s
platform
windows7_x64
resource
win7-20220414-en
submitted
08-07-2022 16:37

Sharing

Report Analysis Logs

General

Target

6db136f2044fcbb7b9a15f63c6969639b7637c4a47ffb5ae3d1522489412b9d4.exe
Size

2.7MB
MD5

2f747ac7c1f8eb239f750afbb8a16305
SHA1

ae96c7ba420e241647caca72c1c66838d9b039a7
SHA256

6db136f2044fcbb7b9a15f63c6969639b7637c4a47ffb5ae3d1522489412b9d4
SHA512

c4f83396016ab862a01bc787979191bb8dee2c91ccdc998fd76504910fc61f523ea81ee2df97facd2ae91fa44d6355412c5fea1c76ce3277c66db7ae0b597556

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1228 1652 WerFault.exe 6db136f2044fcbb7b9a15f63c6969639b7637c4a47ffb5ae3d1522489412b9d4.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6db136f2044fcbb7b9a15f63c6969639b7637c4a47ffb5ae3d1522489412b9d4.exe

description	pid	process	target process
PID 1652 wrote to memory of 1228	1652	6db136f2044fcbb7b9a15f63c6969639b7637c4a47ffb5ae3d1522489412b9d4.exe	WerFault.exe
PID 1652 wrote to memory of 1228	1652	6db136f2044fcbb7b9a15f63c6969639b7637c4a47ffb5ae3d1522489412b9d4.exe	WerFault.exe
PID 1652 wrote to memory of 1228	1652	6db136f2044fcbb7b9a15f63c6969639b7637c4a47ffb5ae3d1522489412b9d4.exe	WerFault.exe
PID 1652 wrote to memory of 1228	1652	6db136f2044fcbb7b9a15f63c6969639b7637c4a47ffb5ae3d1522489412b9d4.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\6db136f2044fcbb7b9a15f63c6969639b7637c4a47ffb5ae3d1522489412b9d4.exe
"C:\Users\Admin\AppData\Local\Temp\6db136f2044fcbb7b9a15f63c6969639b7637c4a47ffb5ae3d1522489412b9d4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 48
2⤵
- Program crash
PID:1228

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1228-55-0x0000000000000000-mapping.dmp

Download
memory/1652-54-0x0000000001390000-0x0000000001AA8000-memory.dmp

Filesize
7.1MB

Download