504aba9ffc85b963c92b2725c54b2f16e8dca913b5dbe2b7d75786eee3692a38 | Triage

Analysis

max time kernel
213s
max time network
335s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 09:08

Sharing

Report Analysis Logs

General

Target

©ɱ/046.exe
Size

63KB
MD5

5f9a1da20708e95e8ad4d6ef213b1e00
SHA1

8bf22d7882f392d7240a0f2a481f3e9ac9b02184
SHA256

ff926bf561b7686bc9a0ce7d2df800b8de463b841627bad4edcbdaed2bd0058c
SHA512

71d61a54209e1ce0e6713b59e42658f96b9a040d71d599a3faa3c1e9d01d47eea6e4a82aa643515241c9c18f1e3546defa18b73704213f5bafa609345c685a8f
SSDEEP

1536:nV9Clq6VZeD7AD4THuk+VoULlklI5PvYYslpd7:nV9oOAD4THxbULlkl8PgYsR

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1636 268 WerFault.exe 046.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

046.exe

description	pid	process	target process
PID 268 wrote to memory of 1636	268	046.exe	WerFault.exe
PID 268 wrote to memory of 1636	268	046.exe	WerFault.exe
PID 268 wrote to memory of 1636	268	046.exe	WerFault.exe
PID 268 wrote to memory of 1636	268	046.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\©ɱ\046.exe
"C:\Users\Admin\AppData\Local\Temp\©ɱ\046.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 268 -s 36
2⤵
- Program crash
PID:1636

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/268-54-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1636-55-0x0000000000000000-mapping.dmp

Download