80da53f0909bc15d1a0362a2c738e5c475d060f91e054ecb36ec30ac92318ccc | Triage

Analysis

max time kernel
39s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 08:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

80da53f0909bc15d1a0362a2c738e5c475d060f91e054ecb36ec30ac92318ccc.exe
Size

1024B
MD5

abefd6cccbf2f47dbba87006b8c77302
SHA1

d08278fed9902d075c9270660c8a62056ed46f29
SHA256

80da53f0909bc15d1a0362a2c738e5c475d060f91e054ecb36ec30ac92318ccc
SHA512

6c357298644454a666af88c2fb16b859810235b55b08f6a04999988947f44346381b1a5df11cadbaf6ceb20100f042d2d9349f06b11c02aabad5793b1c59d7e1

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
952	1476	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 952	1476	80da53f0909bc15d1a0362a2c738e5c475d060f91e054ecb36ec30ac92318ccc.exe	28
PID 1476 wrote to memory of 952	1476	80da53f0909bc15d1a0362a2c738e5c475d060f91e054ecb36ec30ac92318ccc.exe	28
PID 1476 wrote to memory of 952	1476	80da53f0909bc15d1a0362a2c738e5c475d060f91e054ecb36ec30ac92318ccc.exe	28
PID 1476 wrote to memory of 952	1476	80da53f0909bc15d1a0362a2c738e5c475d060f91e054ecb36ec30ac92318ccc.exe	28

C:\Users\Admin\AppData\Local\Temp\80da53f0909bc15d1a0362a2c738e5c475d060f91e054ecb36ec30ac92318ccc.exe
"C:\Users\Admin\AppData\Local\Temp\80da53f0909bc15d1a0362a2c738e5c475d060f91e054ecb36ec30ac92318ccc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 88
  2⤵
  - Program crash
  PID:952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1476-55-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download