7679ebcd5161dcaa77c8a13cbb507ff7fc1568b1f571fdd9a61643dbe8f1ecaf | Triage

Analysis

max time kernel
5s
max time network
48s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
31-07-2022 04:58

Sharing

Report Analysis Logs

General

Target

7679ebcd5161dcaa77c8a13cbb507ff7fc1568b1f571fdd9a61643dbe8f1ecaf.exe
Size

3.4MB
MD5

6fdcb9087ea977bc305e470736b75b07
SHA1

daa06eddba68a942998f7af0fee6e554761adc95
SHA256

7679ebcd5161dcaa77c8a13cbb507ff7fc1568b1f571fdd9a61643dbe8f1ecaf
SHA512

40a86a792252ec34cd0498d3b9e54177a0f9000e05494d5e73bbe19ef8e3a321cc5b083cff5065cfbf57cb0c5e9bcf30a0c0b1a96f815db9cdf99ff137f4449f

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1328 1652 WerFault.exe 7679ebcd5161dcaa77c8a13cbb507ff7fc1568b1f571fdd9a61643dbe8f1ecaf.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

7679ebcd5161dcaa77c8a13cbb507ff7fc1568b1f571fdd9a61643dbe8f1ecaf.exe

description	pid	process	target process
PID 1652 wrote to memory of 1328	1652	7679ebcd5161dcaa77c8a13cbb507ff7fc1568b1f571fdd9a61643dbe8f1ecaf.exe	WerFault.exe
PID 1652 wrote to memory of 1328	1652	7679ebcd5161dcaa77c8a13cbb507ff7fc1568b1f571fdd9a61643dbe8f1ecaf.exe	WerFault.exe
PID 1652 wrote to memory of 1328	1652	7679ebcd5161dcaa77c8a13cbb507ff7fc1568b1f571fdd9a61643dbe8f1ecaf.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\7679ebcd5161dcaa77c8a13cbb507ff7fc1568b1f571fdd9a61643dbe8f1ecaf.exe
"C:\Users\Admin\AppData\Local\Temp\7679ebcd5161dcaa77c8a13cbb507ff7fc1568b1f571fdd9a61643dbe8f1ecaf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1652 -s 36
  2⤵
  - Program crash
  PID:1328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1328-54-0x0000000000000000-mapping.dmp

Download