fb1d3d62de3f3547e33acb8ec37844e03510aa1f112f8892b186ac460177a776 | Triage

Analysis

max time kernel
47s
max time network
51s
platform
windows7_x64
resource
win7-20220414-en
submitted
11-07-2022 10:48

Sharing

Report Analysis Logs

General

Target

4696-141-0x000000007F620000-0x000000007F627000-memory.exe
Size

28KB
MD5

21ec2cac8a3511f6a3d1ade20d5c1e38
SHA1

43dbf185d1e05789f1cc704fcb79591ecb3bbaca
SHA256

fb1d3d62de3f3547e33acb8ec37844e03510aa1f112f8892b186ac460177a776
SHA512

4ffba22c2cffa1ad58a8a995edf1ac2e4217d92fe9ada9eb89c5e76115ec7a189f2173d35d21c18926dc7ebef554f9266f8dbba45fbb7a1e6213fa87abc622fa

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1752 1528 WerFault.exe 4696-141-0x000000007F620000-0x000000007F627000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

4696-141-0x000000007F620000-0x000000007F627000-memory.exe

description	pid	process	target process
PID 1528 wrote to memory of 1752	1528	4696-141-0x000000007F620000-0x000000007F627000-memory.exe	WerFault.exe
PID 1528 wrote to memory of 1752	1528	4696-141-0x000000007F620000-0x000000007F627000-memory.exe	WerFault.exe
PID 1528 wrote to memory of 1752	1528	4696-141-0x000000007F620000-0x000000007F627000-memory.exe	WerFault.exe
PID 1528 wrote to memory of 1752	1528	4696-141-0x000000007F620000-0x000000007F627000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\4696-141-0x000000007F620000-0x000000007F627000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\4696-141-0x000000007F620000-0x000000007F627000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 36
2⤵
- Program crash
PID:1752

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1528-55-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1752-54-0x0000000000000000-mapping.dmp

Download