f1595d131565081a1f69d10f083b75aef447f9230901f51b35885a7640952ba4 | Triage

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 06:03

Sharing

Report Analysis Logs

General

Target

Email Access Checker/configs/svchost.exe
Size

15KB
MD5

bef80f0cc7b0229d8520f4af100e6d4d
SHA1

b725564836833b22034c7b060b5e1bc5d6e5602c
SHA256

ad0655f47d4d5d5d790e374474fbcb1638da17fc352b93e20f8358dd14afb881
SHA512

0d539063a70e4c24f98f82eccc9e9b1f5736cc159dfea49bea5223e79709c8b5509a6c63c967f92903fe9d78607857b276a50f71bc360879404adde7b0e28b9e
SSDEEP

384:zGxiSy04Ri5C6I9jBYm7hZv8TSreSz+kk13yJP:zGxFA5DJeSQ3yJP

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1696 1968 WerFault.exe svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

svchost.exe

description	pid	process	target process
PID 1968 wrote to memory of 1696	1968	svchost.exe	WerFault.exe
PID 1968 wrote to memory of 1696	1968	svchost.exe	WerFault.exe
PID 1968 wrote to memory of 1696	1968	svchost.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Email Access Checker\configs\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\Email Access Checker\configs\svchost.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1968

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1968 -s 600
2⤵
- Program crash
PID:1696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1696-57-0x0000000000000000-mapping.dmp

Download
memory/1968-54-0x0000000000BA0000-0x0000000000BAA000-memory.dmp

Filesize
40KB

Download
memory/1968-55-0x0000000000240000-0x000000000024A000-memory.dmp

Filesize
40KB

Download
memory/1968-56-0x0000000000260000-0x000000000027C000-memory.dmp

Filesize
112KB

Download