hermeticwiper | 811122d2e28ab312d1ac572a9f01b536d692dc7a616603bd0e64976e9b21d55b | Triage

Analysis

max time kernel
32s
max time network
50s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-08-2022 20:22

Sharing

Report Analysis Logs

General

Target

318b972f1fb82f4aeda8e87c0bd5ddd0.exe
Size

114KB
MD5

318b972f1fb82f4aeda8e87c0bd5ddd0
SHA1

3b6d33a5d83e1647dd9ec9fd2bb5789717f448a6
SHA256

811122d2e28ab312d1ac572a9f01b536d692dc7a616603bd0e64976e9b21d55b
SHA512

2f7631a88416958c5dd877887ac62046926f916396c30cf809ba89057be64b60f9c49bf6e7cfbfde54274d67f4254a2212597e6749dfa27503bc822c38544203
SSDEEP

1536:HFkQITufwkfWDurilmw9BgjKu1sPPxaS4jqY:HWQITufwkeDxlPwV16PkS4jqY

Score

10^/10

hermeticwiper wiper

Malware Config

Signatures

Detect HermeticWiper 1 IoCs

Detect HermeticWiper Payload.

resource	yara_rule
behavioral1/memory/1016-56-0x00000000008F0000-0x000000000090F000-memory.dmp	family_hermeticwiper

HermeticWiper
HermeticWiper is a partition-corrupting malware used in cyberattacks against Ukrainian organizations.
wiper hermeticwiper

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2032	1016	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 2032	1016	318b972f1fb82f4aeda8e87c0bd5ddd0.exe	28
PID 1016 wrote to memory of 2032	1016	318b972f1fb82f4aeda8e87c0bd5ddd0.exe	28
PID 1016 wrote to memory of 2032	1016	318b972f1fb82f4aeda8e87c0bd5ddd0.exe	28
PID 1016 wrote to memory of 2032	1016	318b972f1fb82f4aeda8e87c0bd5ddd0.exe	28

C:\Users\Admin\AppData\Local\Temp\318b972f1fb82f4aeda8e87c0bd5ddd0.exe
"C:\Users\Admin\AppData\Local\Temp\318b972f1fb82f4aeda8e87c0bd5ddd0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 116
  2⤵
  - Program crash
  PID:2032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1016-54-0x00000000756B1000-0x00000000756B3000-memory.dmp

Filesize
8KB

Download
memory/1016-56-0x00000000008F0000-0x000000000090F000-memory.dmp

Filesize
124KB

Download