25af995a82a695829d5e73eb82d0ab9ccccae43fafd076b45625ab81d3c3bc82 | Triage

Analysis

max time kernel
38s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-08-2022 16:07

Sharing

Report Analysis Logs

General

Target

25af995a82a695829d5e73eb82d0ab9ccccae43fafd076b45625ab81d3c3bc82.exe
Size

718KB
MD5

247455c8833c8a11511b4437ba149778
SHA1

6831589bc510408b5d80a775f55fe1c9463f9e8e
SHA256

25af995a82a695829d5e73eb82d0ab9ccccae43fafd076b45625ab81d3c3bc82
SHA512

30e65f8b67a07f1dcc43bee23d8c54bcaccf2398f09949c0f4e97e67028cbacabb77fe6c18bac4ade7f4e61b09ab484bd654cf7dfdfbf3aedc8723fb236ee814

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1952 1976 WerFault.exe 25af995a82a695829d5e73eb82d0ab9ccccae43fafd076b45625ab81d3c3bc82.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

25af995a82a695829d5e73eb82d0ab9ccccae43fafd076b45625ab81d3c3bc82.exe

description	pid	process	target process
PID 1976 wrote to memory of 1952	1976	25af995a82a695829d5e73eb82d0ab9ccccae43fafd076b45625ab81d3c3bc82.exe	WerFault.exe
PID 1976 wrote to memory of 1952	1976	25af995a82a695829d5e73eb82d0ab9ccccae43fafd076b45625ab81d3c3bc82.exe	WerFault.exe
PID 1976 wrote to memory of 1952	1976	25af995a82a695829d5e73eb82d0ab9ccccae43fafd076b45625ab81d3c3bc82.exe	WerFault.exe
PID 1976 wrote to memory of 1952	1976	25af995a82a695829d5e73eb82d0ab9ccccae43fafd076b45625ab81d3c3bc82.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\25af995a82a695829d5e73eb82d0ab9ccccae43fafd076b45625ab81d3c3bc82.exe
"C:\Users\Admin\AppData\Local\Temp\25af995a82a695829d5e73eb82d0ab9ccccae43fafd076b45625ab81d3c3bc82.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 96
2⤵
- Program crash
PID:1952

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1952-54-0x0000000000000000-mapping.dmp

Download