1b985ca2f29c8079d6fe60804a838989582e11724e7b1ab75f393f01b941806d | Triage

Analysis

max time kernel
41s
max time network
44s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
12-08-2022 01:25

Sharing

Report Analysis Logs

General

Target

d952bdc073ff3deb4bcc3cb96cbacd01.exe
Size

708KB
MD5

d952bdc073ff3deb4bcc3cb96cbacd01
SHA1

6d283b4acf37dcea8d9f62cf09ddf5deb5c6c5cd
SHA256

1b985ca2f29c8079d6fe60804a838989582e11724e7b1ab75f393f01b941806d
SHA512

19781a2787e53c89d7006aba1f68047fabaf74e18d13b081df18498a677d68518a62c8c41d21770999ef770a89ae88a7bdc0b8dcc197262b109b24160d974974

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1272 892 WerFault.exe d952bdc073ff3deb4bcc3cb96cbacd01.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

d952bdc073ff3deb4bcc3cb96cbacd01.exe

description	pid	process	target process
PID 892 wrote to memory of 1272	892	d952bdc073ff3deb4bcc3cb96cbacd01.exe	WerFault.exe
PID 892 wrote to memory of 1272	892	d952bdc073ff3deb4bcc3cb96cbacd01.exe	WerFault.exe
PID 892 wrote to memory of 1272	892	d952bdc073ff3deb4bcc3cb96cbacd01.exe	WerFault.exe
PID 892 wrote to memory of 1272	892	d952bdc073ff3deb4bcc3cb96cbacd01.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\d952bdc073ff3deb4bcc3cb96cbacd01.exe
"C:\Users\Admin\AppData\Local\Temp\d952bdc073ff3deb4bcc3cb96cbacd01.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 892 -s 48
2⤵
- Program crash
PID:1272

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1272-54-0x0000000000000000-mapping.dmp

Download