f650391011991b75b2de45688bdadbfb95057a2b0ed360607a9fa3233a4f5045 | Triage

Analysis

max time kernel
34s
max time network
135s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 03:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f650391011991b75b2de45688bdadbfb95057a2b0ed360607a9fa3233a4f5045.exe
Size

2KB
MD5

a8c40e928fb73655f856c7735e311665
SHA1

aa162eb085b482eda4a31c5df9e007652f59f20b
SHA256

f650391011991b75b2de45688bdadbfb95057a2b0ed360607a9fa3233a4f5045
SHA512

937f23a19b0364ddbb0dae8ea1753dbb5c5c335d91e3dfbf920689cf6b5af2d5c7cd1f40f3cdff0c16bd568bb65376a84790606496a09ef28dc1b8ddd95fb5f9

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1240	580	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 580 wrote to memory of 1240	580	f650391011991b75b2de45688bdadbfb95057a2b0ed360607a9fa3233a4f5045.exe	28
PID 580 wrote to memory of 1240	580	f650391011991b75b2de45688bdadbfb95057a2b0ed360607a9fa3233a4f5045.exe	28
PID 580 wrote to memory of 1240	580	f650391011991b75b2de45688bdadbfb95057a2b0ed360607a9fa3233a4f5045.exe	28
PID 580 wrote to memory of 1240	580	f650391011991b75b2de45688bdadbfb95057a2b0ed360607a9fa3233a4f5045.exe	28

C:\Users\Admin\AppData\Local\Temp\f650391011991b75b2de45688bdadbfb95057a2b0ed360607a9fa3233a4f5045.exe
"C:\Users\Admin\AppData\Local\Temp\f650391011991b75b2de45688bdadbfb95057a2b0ed360607a9fa3233a4f5045.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:580
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 36
  2⤵
  - Program crash
  PID:1240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads