47cc654925b72dc0dfefc34616c1760a680cb30f8973422c7bbc2a550ee1e1b8 | Triage

Analysis

max time kernel
93s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
14-07-2022 05:28

Sharing

Report Analysis Logs

General

Target

47cc654925b72dc0dfefc34616c1760a680cb30f8973422c7bbc2a550ee1e1b8.exe
Size

1.8MB
MD5

9130e049de92565fd94684020cfcdad9
SHA1

332701ac6a0b868468d02e8e1f4f0995e40affb2
SHA256

47cc654925b72dc0dfefc34616c1760a680cb30f8973422c7bbc2a550ee1e1b8
SHA512

2f8323a3c364fdcadfc1a06b1aee5ce7bedd7b056d913d8a19ad5a26bc33b2274e257713a75d335af0d7460f2a04ff91859c9567dd0ca694cf6304098d636a1e

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4776	4352	WerFault.exe	80

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\	47cc654925b72dc0dfefc34616c1760a680cb30f8973422c7bbc2a550ee1e1b8.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4352	47cc654925b72dc0dfefc34616c1760a680cb30f8973422c7bbc2a550ee1e1b8.exe

C:\Users\Admin\AppData\Local\Temp\47cc654925b72dc0dfefc34616c1760a680cb30f8973422c7bbc2a550ee1e1b8.exe
"C:\Users\Admin\AppData\Local\Temp\47cc654925b72dc0dfefc34616c1760a680cb30f8973422c7bbc2a550ee1e1b8.exe"
1⤵
- NTFS ADS
- Suspicious behavior: RenamesItself
PID:4352
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 988
  2⤵
  - Program crash
  PID:4776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4352 -ip 4352
1⤵
PID:1604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads