Analysis
-
max time kernel
142s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02-10-2022 15:57
Static task
static1
Behavioral task
behavioral1
Sample
475a18d343b1bf374dd244cde93e05d11f1e152afda0d0174dda990ff7c50adc.exe
Resource
win7-20220812-en
windows7-x64
2 signatures
150 seconds
General
-
Target
475a18d343b1bf374dd244cde93e05d11f1e152afda0d0174dda990ff7c50adc.exe
-
Size
674KB
-
MD5
7035c7e580440f49a9c218f44996255d
-
SHA1
d52d94dbc07e7a0dbf3890fa4a2cdd851e1937a9
-
SHA256
475a18d343b1bf374dd244cde93e05d11f1e152afda0d0174dda990ff7c50adc
-
SHA512
3cd94363d1748da679d34180bc4838a3967306644ad7611c378a37f7ccc8d79df7bf8e2b12ec8bd5f94032e0e0403df3c3ca4f55747e682edc88dc2db8a4e9ba
-
SSDEEP
12288:S3TdtLW5WIj1YSSdFx1s1PB25vBSXyMzBUWb9lx/9AgHLo8OW+rB8:sDsj1dECp8pBcJ9nPx/igrp+q
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1984 1976 WerFault.exe 475a18d343b1bf374dd244cde93e05d11f1e152afda0d0174dda990ff7c50adc.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
475a18d343b1bf374dd244cde93e05d11f1e152afda0d0174dda990ff7c50adc.exedescription pid process target process PID 1976 wrote to memory of 1984 1976 475a18d343b1bf374dd244cde93e05d11f1e152afda0d0174dda990ff7c50adc.exe WerFault.exe PID 1976 wrote to memory of 1984 1976 475a18d343b1bf374dd244cde93e05d11f1e152afda0d0174dda990ff7c50adc.exe WerFault.exe PID 1976 wrote to memory of 1984 1976 475a18d343b1bf374dd244cde93e05d11f1e152afda0d0174dda990ff7c50adc.exe WerFault.exe PID 1976 wrote to memory of 1984 1976 475a18d343b1bf374dd244cde93e05d11f1e152afda0d0174dda990ff7c50adc.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\475a18d343b1bf374dd244cde93e05d11f1e152afda0d0174dda990ff7c50adc.exe"C:\Users\Admin\AppData\Local\Temp\475a18d343b1bf374dd244cde93e05d11f1e152afda0d0174dda990ff7c50adc.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 1922⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1976-54-0x00000000754E1000-0x00000000754E3000-memory.dmpFilesize
8KB
-
memory/1976-55-0x0000000000400000-0x00000000004CD000-memory.dmpFilesize
820KB
-
memory/1976-57-0x0000000000400000-0x00000000004CD000-memory.dmpFilesize
820KB
-
memory/1984-56-0x0000000000000000-mapping.dmp