ca1906c0038d784d0ae122797eb5a2c359aeabd142efa34f709c229bec4cd3cc | Triage

Analysis

max time kernel
110s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
31-10-2022 05:03

Sharing

Report Analysis Logs

General

Target

L2NPC/L2NPC.exe
Size

3.0MB
MD5

600a18faebf9f776e6da00130c6c158c
SHA1

c1a7ca76a50dea5938615ae247aba2bffe8c3740
SHA256

70ca305182907b39e56373a6ef7d43adbb668e86983afd1b851a5640954950ca
SHA512

0f47ea1f15e43a5bb41169e8032de8d3e58e444860fb7eebb45bc496b403e1000863241ad89dfe5e5347cdb12a5ae013ee0173e69b0bc26e79a8af7d9929b59b
SSDEEP

49152:y8kv1/vPS8dBzeuKsmri+wnbQLkVlRI4V2RaJLSoRkxjUzg+p9wr:+pBRnwJUzg+p9

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4696	420	WerFault.exe	80
4264	420	WerFault.exe	80

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 420 wrote to memory of 4696	420	L2NPC.exe	83
PID 420 wrote to memory of 4696	420	L2NPC.exe	83

C:\Users\Admin\AppData\Local\Temp\L2NPC\L2NPC.exe
"C:\Users\Admin\AppData\Local\Temp\L2NPC\L2NPC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:420
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 420 -s 376
  2⤵
  - Program crash
  PID:4696
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 420 -s 376
  2⤵
  - Program crash
  PID:4264

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 432 -p 420 -ip 420
1⤵
PID:4324

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads