56a8832a8fe73bc31a8d7f1d6c5e101db792ea7efd220f74e1b1263359057b09 | Triage

Analysis

max time kernel
61s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
25-07-2022 02:05

Sharing

Report Analysis Logs

General

Target

56a8832a8fe73bc31a8d7f1d6c5e101db792ea7efd220f74e1b1263359057b09.exe
Size

1.0MB
MD5

7693700a5eb55f2442a6ec0400872661
SHA1

51db686d92d80d48ee48905f5d0e853d4513ca5a
SHA256

56a8832a8fe73bc31a8d7f1d6c5e101db792ea7efd220f74e1b1263359057b09
SHA512

ba5621a0cf0b07a3a5f669046531f598cc4f9497ba888e1eb59ac08b47fe7df3d34067c70e3daca458df339411bab21a518d487010bf4a94b4b2598af5a7a2b8

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4244 2072 WerFault.exe 56a8832a8fe73bc31a8d7f1d6c5e101db792ea7efd220f74e1b1263359057b09.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

56a8832a8fe73bc31a8d7f1d6c5e101db792ea7efd220f74e1b1263359057b09.exe

pid process

2072 56a8832a8fe73bc31a8d7f1d6c5e101db792ea7efd220f74e1b1263359057b09.exe

C:\Users\Admin\AppData\Local\Temp\56a8832a8fe73bc31a8d7f1d6c5e101db792ea7efd220f74e1b1263359057b09.exe
"C:\Users\Admin\AppData\Local\Temp\56a8832a8fe73bc31a8d7f1d6c5e101db792ea7efd220f74e1b1263359057b09.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 380
2⤵
- Program crash
PID:4244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2072 -ip 2072
1⤵
PID:3536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2072-130-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download