4a90cac96c04e3cf0b797290dbcc1403d36fd6a6fa26e87c865283ec4086621b | Triage

Analysis

max time kernel
38s
max time network
45s
platform
windows7_x64
resource
win7-20220414-en
submitted
12-07-2022 12:50

Sharing

Report Analysis Logs

General

Target

4a90cac96c04e3cf0b797290dbcc1403d36fd6a6fa26e87c865283ec4086621b.exe
Size

79KB
MD5

c82d0e4f5eab0bc5c26f79628cbef4fc
SHA1

68e68a909a04803528d156b4705567164c221270
SHA256

4a90cac96c04e3cf0b797290dbcc1403d36fd6a6fa26e87c865283ec4086621b
SHA512

8a272a263ce742b84c1a99ae5073a735c71381257382811914f995aaf7f04d24bff669116786b113a9b2c6ca5400523acb7a69fa89d2f135af593673055ead8a

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

272 1732 WerFault.exe 4a90cac96c04e3cf0b797290dbcc1403d36fd6a6fa26e87c865283ec4086621b.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

4a90cac96c04e3cf0b797290dbcc1403d36fd6a6fa26e87c865283ec4086621b.exe

description	pid	process	target process
PID 1732 wrote to memory of 272	1732	4a90cac96c04e3cf0b797290dbcc1403d36fd6a6fa26e87c865283ec4086621b.exe	WerFault.exe
PID 1732 wrote to memory of 272	1732	4a90cac96c04e3cf0b797290dbcc1403d36fd6a6fa26e87c865283ec4086621b.exe	WerFault.exe
PID 1732 wrote to memory of 272	1732	4a90cac96c04e3cf0b797290dbcc1403d36fd6a6fa26e87c865283ec4086621b.exe	WerFault.exe
PID 1732 wrote to memory of 272	1732	4a90cac96c04e3cf0b797290dbcc1403d36fd6a6fa26e87c865283ec4086621b.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\4a90cac96c04e3cf0b797290dbcc1403d36fd6a6fa26e87c865283ec4086621b.exe
"C:\Users\Admin\AppData\Local\Temp\4a90cac96c04e3cf0b797290dbcc1403d36fd6a6fa26e87c865283ec4086621b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 68
2⤵
- Program crash
PID:272

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/272-55-0x0000000000000000-mapping.dmp

Download
memory/1732-54-0x0000000001000000-0x0000000001015000-memory.dmp

Filesize
84KB

Download