3680f1622fa02b2efb460395d59f3f69b79e6e87154d62008ab66ae4cbfdd4f6 | Triage

Analysis

max time kernel
44s
max time network
50s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
16-07-2022 08:11

Sharing

Report Analysis Logs

General

Target

1128-61-0x0000000000680000-0x000000000173A000-memory.exe
Size

16.7MB
MD5

1801b8c4b5265812c1bf5550cf542100
SHA1

48a9fc20d2c9c248e50c74e08937877d7f285fc1
SHA256

3680f1622fa02b2efb460395d59f3f69b79e6e87154d62008ab66ae4cbfdd4f6
SHA512

111736c3560915dfc76dcabf012231de7462cb9d0b4d244b5f701161a8d1dd7ec98f84c5b5068cd74df231660f161b5dfdd6504fafe692f1569ced5986c1442a

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1088 836 WerFault.exe 1128-61-0x0000000000680000-0x000000000173A000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1128-61-0x0000000000680000-0x000000000173A000-memory.exe

description	pid	process	target process
PID 836 wrote to memory of 1088	836	1128-61-0x0000000000680000-0x000000000173A000-memory.exe	WerFault.exe
PID 836 wrote to memory of 1088	836	1128-61-0x0000000000680000-0x000000000173A000-memory.exe	WerFault.exe
PID 836 wrote to memory of 1088	836	1128-61-0x0000000000680000-0x000000000173A000-memory.exe	WerFault.exe
PID 836 wrote to memory of 1088	836	1128-61-0x0000000000680000-0x000000000173A000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1128-61-0x0000000000680000-0x000000000173A000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1128-61-0x0000000000680000-0x000000000173A000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 836 -s 36
2⤵
- Program crash
PID:1088

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1088-54-0x0000000000000000-mapping.dmp

Download