5f169cada11fffca75af5eb67f6d0fd92c1042cca1ed460aa7196e4a9ecbb1a5 | Triage

Analysis

max time kernel
33s
max time network
48s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
31-07-2022 18:18

Sharing

Report Analysis Logs

General

Target

5f169cada11fffca75af5eb67f6d0fd92c1042cca1ed460aa7196e4a9ecbb1a5.exe
Size

160KB
MD5

0c4d08e0b8da928708643b270420852d
SHA1

fcc3d633223a431ccc725c89403730ef506b49d7
SHA256

5f169cada11fffca75af5eb67f6d0fd92c1042cca1ed460aa7196e4a9ecbb1a5
SHA512

baf7d0ab12f2f0133b24daf6b3cc046c2cc4963de5926e611cd4138d2c49df860e339d39d99a4c17435f00ddcc640a87295a5fbfb688fef044f1d7a0b5b97605

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1244 2016 WerFault.exe 5f169cada11fffca75af5eb67f6d0fd92c1042cca1ed460aa7196e4a9ecbb1a5.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

5f169cada11fffca75af5eb67f6d0fd92c1042cca1ed460aa7196e4a9ecbb1a5.exe

pid process

2016 5f169cada11fffca75af5eb67f6d0fd92c1042cca1ed460aa7196e4a9ecbb1a5.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

5f169cada11fffca75af5eb67f6d0fd92c1042cca1ed460aa7196e4a9ecbb1a5.exe

description	pid	process	target process
PID 2016 wrote to memory of 1244	2016	5f169cada11fffca75af5eb67f6d0fd92c1042cca1ed460aa7196e4a9ecbb1a5.exe	WerFault.exe
PID 2016 wrote to memory of 1244	2016	5f169cada11fffca75af5eb67f6d0fd92c1042cca1ed460aa7196e4a9ecbb1a5.exe	WerFault.exe
PID 2016 wrote to memory of 1244	2016	5f169cada11fffca75af5eb67f6d0fd92c1042cca1ed460aa7196e4a9ecbb1a5.exe	WerFault.exe
PID 2016 wrote to memory of 1244	2016	5f169cada11fffca75af5eb67f6d0fd92c1042cca1ed460aa7196e4a9ecbb1a5.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\5f169cada11fffca75af5eb67f6d0fd92c1042cca1ed460aa7196e4a9ecbb1a5.exe
"C:\Users\Admin\AppData\Local\Temp\5f169cada11fffca75af5eb67f6d0fd92c1042cca1ed460aa7196e4a9ecbb1a5.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 348
2⤵
- Program crash
PID:1244

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1244-58-0x0000000000000000-mapping.dmp

Download
memory/2016-56-0x0000000076321000-0x0000000076323000-memory.dmp

Filesize
8KB

Download
memory/2016-59-0x0000000000270000-0x000000000027A000-memory.dmp

Filesize
40KB

Download
memory/2016-57-0x0000000003461000-0x0000000003466000-memory.dmp

Filesize
20KB

Download
memory/2016-60-0x0000000000270000-0x000000000027A000-memory.dmp

Filesize
40KB

Download