Analysis

  • max time kernel
    336s
  • max time network
    399s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/12/2022, 07:43

General

  • Target

    90a1afa7f79db333125b8e28cd85b4624af46d1853dea8af56e8383796daaa2f.exe

  • Size

    180KB

  • MD5

    99a6c932299f6fefcd309b5df856144a

  • SHA1

    6f9d7ae184364f01a2de88a622595d88beaaf34f

  • SHA256

    90a1afa7f79db333125b8e28cd85b4624af46d1853dea8af56e8383796daaa2f

  • SHA512

    48caa8aee227b4b9653e3e26a294d687bbf20c5c953b707091e89a418590bd288925606ce2a133fdda1b2b96404b6c01f2e97c70dbd0e17f00571003dfd16461

  • SSDEEP

    3072:8/Y8pA0noJD0hCkIThWQIKXTZaZN6V4y5NfAi:8/jMJ5J1zJXoH/i

Score
3/10

Malware Config

Signatures

  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\90a1afa7f79db333125b8e28cd85b4624af46d1853dea8af56e8383796daaa2f.exe
    "C:\Users\Admin\AppData\Local\Temp\90a1afa7f79db333125b8e28cd85b4624af46d1853dea8af56e8383796daaa2f.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2488
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 488
      2⤵
      • Program crash
      PID:2520
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 488
      2⤵
      • Program crash
      PID:3560
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2488 -ip 2488
    1⤵
      PID:4620

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2488-132-0x0000000000400000-0x0000000000448000-memory.dmp

      Filesize

      288KB