85597c215a8a6a3c6093941998f05775811b40fecc31789291cbd4a96121524d | Triage

Analysis

max time kernel
228s
max time network
335s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 06:32

Sharing

Report Analysis Logs

General

Target

UNINST~1.exe
Size

32KB
MD5

8465192b9a8752ddd5829cb8d2ff17fe
SHA1

15a350ba63ee8880787b6fd3af6446046c796d0c
SHA256

fd730d73f5a2ca5c6fd0a6ae82153adf80f5b99d826004a419e69c0d15e91f68
SHA512

8eeaf57cc6c8dfdd172725fb9d2512e2a7b3c709834fd89cb0009625082477098a463a0fbcc45547a4be6c821e7a5813b4b73d210dc2defc61bb06d5c0a20c3c
SSDEEP

768:d4iFpuIy5DHyfxd2wXWGgfehbTuM0PBqKO7YqbMUPP4N1:qyuzsd2Sg2UFBNOBb/ID

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1664	852	WerFault.exe	19

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 1664	852	UNINST~1.exe	28
PID 852 wrote to memory of 1664	852	UNINST~1.exe	28
PID 852 wrote to memory of 1664	852	UNINST~1.exe	28
PID 852 wrote to memory of 1664	852	UNINST~1.exe	28
PID 852 wrote to memory of 1664	852	UNINST~1.exe	28
PID 852 wrote to memory of 1664	852	UNINST~1.exe	28
PID 852 wrote to memory of 1664	852	UNINST~1.exe	28

C:\Users\Admin\AppData\Local\Temp\UNINST~1.exe
"C:\Users\Admin\AppData\Local\Temp\UNINST~1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 852 -s 284
  2⤵
  - Program crash
  PID:1664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/852-54-0x0000000075E01000-0x0000000075E03000-memory.dmp

Filesize
8KB

Download
memory/852-56-0x0000000000240000-0x0000000000247000-memory.dmp

Filesize
28KB

Download
memory/852-57-0x0000000000240000-0x0000000000247000-memory.dmp

Filesize
28KB

Download