02942bca52ae938e557a0ad930a8fe0627b0276ff18b10204b4b48fd6c3f3041

Analysis

max time kernel
130s
max time network
186s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
03/12/2022, 17:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02942bca52ae938e557a0ad930a8fe0627b0276ff18b10204b4b48fd6c3f3041.exe
Size

1.9MB
MD5

02daf377b431f6582e68bc5735cf543e
SHA1

1ee9cd940d6592f162bbbde3e8653aa854342840
SHA256

02942bca52ae938e557a0ad930a8fe0627b0276ff18b10204b4b48fd6c3f3041
SHA512

7923a7189556123a3960d6e53b7c4315464590cbe264cd1cc7350c2f3ad6537b4128249be48c9282469a721fda20b4cd9a9c19c43ba1c3743e2ad49abcbf092b
SSDEEP

49152:AJckrET0H4kWHIQrLxlLaP1jn7MC5sIilE260/y:AJay1QkjrsIz2g

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5096	2664	WerFault.exe	65
4256	2664	WerFault.exe	65

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 5088	2664	02942bca52ae938e557a0ad930a8fe0627b0276ff18b10204b4b48fd6c3f3041.exe	67
PID 2664 wrote to memory of 5088	2664	02942bca52ae938e557a0ad930a8fe0627b0276ff18b10204b4b48fd6c3f3041.exe	67
PID 2664 wrote to memory of 5088	2664	02942bca52ae938e557a0ad930a8fe0627b0276ff18b10204b4b48fd6c3f3041.exe	67
PID 2664 wrote to memory of 5088	2664	02942bca52ae938e557a0ad930a8fe0627b0276ff18b10204b4b48fd6c3f3041.exe	67
PID 2664 wrote to memory of 5088	2664	02942bca52ae938e557a0ad930a8fe0627b0276ff18b10204b4b48fd6c3f3041.exe	67
PID 2664 wrote to memory of 5088	2664	02942bca52ae938e557a0ad930a8fe0627b0276ff18b10204b4b48fd6c3f3041.exe	67
PID 2664 wrote to memory of 5088	2664	02942bca52ae938e557a0ad930a8fe0627b0276ff18b10204b4b48fd6c3f3041.exe	67
PID 2664 wrote to memory of 5088	2664	02942bca52ae938e557a0ad930a8fe0627b0276ff18b10204b4b48fd6c3f3041.exe	67
PID 2664 wrote to memory of 5088	2664	02942bca52ae938e557a0ad930a8fe0627b0276ff18b10204b4b48fd6c3f3041.exe	67
PID 2664 wrote to memory of 5088	2664	02942bca52ae938e557a0ad930a8fe0627b0276ff18b10204b4b48fd6c3f3041.exe	67
PID 2664 wrote to memory of 5088	2664	02942bca52ae938e557a0ad930a8fe0627b0276ff18b10204b4b48fd6c3f3041.exe	67
PID 2664 wrote to memory of 5088	2664	02942bca52ae938e557a0ad930a8fe0627b0276ff18b10204b4b48fd6c3f3041.exe	67
PID 2664 wrote to memory of 5088	2664	02942bca52ae938e557a0ad930a8fe0627b0276ff18b10204b4b48fd6c3f3041.exe	67
PID 2664 wrote to memory of 5088	2664	02942bca52ae938e557a0ad930a8fe0627b0276ff18b10204b4b48fd6c3f3041.exe	67
PID 2664 wrote to memory of 5088	2664	02942bca52ae938e557a0ad930a8fe0627b0276ff18b10204b4b48fd6c3f3041.exe	67
PID 2664 wrote to memory of 5088	2664	02942bca52ae938e557a0ad930a8fe0627b0276ff18b10204b4b48fd6c3f3041.exe	67

C:\Users\Admin\AppData\Local\Temp\02942bca52ae938e557a0ad930a8fe0627b0276ff18b10204b4b48fd6c3f3041.exe
"C:\Users\Admin\AppData\Local\Temp\02942bca52ae938e557a0ad930a8fe0627b0276ff18b10204b4b48fd6c3f3041.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\syswow64\rundll32.exe
  "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
  2⤵
  PID:5088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 728
  2⤵
  - Program crash
  PID:5096
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 764
  2⤵
  - Program crash
  PID:4256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2664-115-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-116-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-117-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-118-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-119-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-120-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-121-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-122-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-123-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-124-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-125-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-126-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-127-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-128-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-130-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-131-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-132-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-133-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-134-0x0000000000E50000-0x0000000000FF3000-memory.dmp

Filesize
1.6MB

Download
memory/2664-135-0x0000000001000000-0x00000000013EE000-memory.dmp

Filesize
3.9MB

Download
memory/2664-136-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-137-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-138-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-139-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-140-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-141-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-142-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-143-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-144-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-145-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-146-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-147-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-148-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-149-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-150-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-151-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-152-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-153-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-154-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-155-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-156-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-157-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-158-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-159-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-160-0x0000000000400000-0x00000000007FB000-memory.dmp

Filesize
4.0MB

Download
memory/2664-161-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-162-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-163-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-164-0x0000000000400000-0x00000000007FB000-memory.dmp

Filesize
4.0MB

Download
memory/2664-165-0x0000000000400000-0x00000000007FB000-memory.dmp

Filesize
4.0MB

Download
memory/2664-166-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-167-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2664-168-0x0000000000E50000-0x0000000000FF3000-memory.dmp

Filesize
1.6MB

Download
memory/2664-169-0x0000000001000000-0x00000000013EE000-memory.dmp

Filesize
3.9MB

Download
memory/2664-170-0x0000000000400000-0x00000000007FB000-memory.dmp

Filesize
4.0MB

Download
memory/2664-171-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads