7da3aa518b1d7aedae72c5f2cf6f468443e55fd47118525641cffe9dde0c57d2 | Triage

Analysis

max time kernel
143s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
31-07-2022 07:17

Sharing

Report Analysis Logs

General

Target

7da3aa518b1d7aedae72c5f2cf6f468443e55fd47118525641cffe9dde0c57d2.exe
Size

840KB
MD5

24a32aa58c9467922d58f4bea583cf5e
SHA1

45609e16957b73a8f7930a1956cfa49d487cd8f8
SHA256

7da3aa518b1d7aedae72c5f2cf6f468443e55fd47118525641cffe9dde0c57d2
SHA512

0f059256042b35c43ce71d4463e45e89387129fca8129744edeeeec6f822f379c06d1aa38fd9985d39c984b5254d94f8bfccc91ec4497c5a3f40ab2db7ad16b3

Score

7^/10

Malware Config

Signatures

Drops startup file 2 IoCs

Processes:

7da3aa518b1d7aedae72c5f2cf6f468443e55fd47118525641cffe9dde0c57d2.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JIKMNTRF.url	7da3aa518b1d7aedae72c5f2cf6f468443e55fd47118525641cffe9dde0c57d2.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JIKMNTRF.url	7da3aa518b1d7aedae72c5f2cf6f468443e55fd47118525641cffe9dde0c57d2.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4644 2984 WerFault.exe 7da3aa518b1d7aedae72c5f2cf6f468443e55fd47118525641cffe9dde0c57d2.exe

C:\Users\Admin\AppData\Local\Temp\7da3aa518b1d7aedae72c5f2cf6f468443e55fd47118525641cffe9dde0c57d2.exe
"C:\Users\Admin\AppData\Local\Temp\7da3aa518b1d7aedae72c5f2cf6f468443e55fd47118525641cffe9dde0c57d2.exe"
1⤵
- Drops startup file
PID:2984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 8936
2⤵
- Program crash
PID:4644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2984 -ip 2984
1⤵
PID:4988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2984-130-0x00000000000A0000-0x0000000000178000-memory.dmp

Filesize
864KB

Download
memory/2984-131-0x0000000009660000-0x0000000009C04000-memory.dmp

Filesize
5.6MB

Download
memory/2984-132-0x0000000004B10000-0x0000000004B13000-memory.dmp

Filesize
12KB

Download