91a734562228b80d8c8cf131a07f054d9fbc7709a21dc8f89909a5ccceb1ceb7 | Triage

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-11-2022 07:12

Sharing

Report Analysis Logs

General

Target

7e941ecf4002b95a59a2c8cfe7e88624.exe
Size

867KB
MD5

7e941ecf4002b95a59a2c8cfe7e88624
SHA1

e6ee448fe01db6d60760ed34a283f8172b0e93f2
SHA256

91a734562228b80d8c8cf131a07f054d9fbc7709a21dc8f89909a5ccceb1ceb7
SHA512

c94c3c9f2bff63e7d11273c775f290711c9137db01e3db0373547acdb320ef7d223ebdbb3544cc19aa3a90ecb9abaa4bd4704b3755c696701bc7b3390a588c5d
SSDEEP

24576:43i31tbTIv7798KFjruZWDUfAuTOAM5hSqzH:X31tXmaKFjwWeiAFqzH

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1756 812 WerFault.exe 7e941ecf4002b95a59a2c8cfe7e88624.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

7e941ecf4002b95a59a2c8cfe7e88624.exe

description	pid	process	target process
PID 812 wrote to memory of 1756	812	7e941ecf4002b95a59a2c8cfe7e88624.exe	WerFault.exe
PID 812 wrote to memory of 1756	812	7e941ecf4002b95a59a2c8cfe7e88624.exe	WerFault.exe
PID 812 wrote to memory of 1756	812	7e941ecf4002b95a59a2c8cfe7e88624.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\7e941ecf4002b95a59a2c8cfe7e88624.exe
"C:\Users\Admin\AppData\Local\Temp\7e941ecf4002b95a59a2c8cfe7e88624.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:812

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 812 -s 704
2⤵
- Program crash
PID:1756

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/812-54-0x0000000000260000-0x000000000033C000-memory.dmp

Filesize
880KB

Download
memory/812-55-0x000000001A840000-0x000000001A8F6000-memory.dmp

Filesize
728KB

Download
memory/812-56-0x000000001AF80000-0x000000001B034000-memory.dmp

Filesize
720KB

Download
memory/812-57-0x000000001B1B0000-0x000000001B262000-memory.dmp

Filesize
712KB

Download
memory/1756-58-0x0000000000000000-mapping.dmp

Download