017ab0c10991b0d3faa2b6fdc43487632418c4f5a337e94f8490233d254ba566 | Triage

Analysis

max time kernel
47s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
21-11-2022 21:37

Sharing

Report Analysis Logs

General

Target

out.exe
Size

3.8MB
MD5

4dabc39b211315fe0c40dadb42548d7b
SHA1

43bcb1fa069af7eef462ee94b64365490cb82851
SHA256

92cff45687e5ede616b97ad98db15db5a6a94eb3e2b4c0ce7b18d1d4da8f612f
SHA512

0e16364bba70ea7283b511f76e4f30dd7ecdaab490843832c04f1ba3cf90bd9993283557f088df4707b2248e99bba10442162b368c1043695bf87a646a2fbab4
SSDEEP

98304:m77Pmq33rE/JDLPWZADUGer7B6iY74M/QmlwXVZ:Y+R/eZADUXR

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1252 860 WerFault.exe out.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

out.exe

description	pid	process	target process
PID 860 wrote to memory of 1252	860	out.exe	WerFault.exe
PID 860 wrote to memory of 1252	860	out.exe	WerFault.exe
PID 860 wrote to memory of 1252	860	out.exe	WerFault.exe
PID 860 wrote to memory of 1252	860	out.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\out.exe
"C:\Users\Admin\AppData\Local\Temp\out.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 36
2⤵
- Program crash
PID:1252

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1252-54-0x0000000000000000-mapping.dmp

Download