4af278d681249a1d292e0b0eb662f20ec919f984bf1c3d3ed0cff961fe0ef887 | Triage

Analysis

max time kernel
44s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 14:53

Sharing

Report Analysis Logs

General

Target

PAYMENT ADVICE.exe
Size

471KB
MD5

20c4471b875e64c7943c225a359eb227
SHA1

3551c6ddbe76927927a22262af48c225a9c28d6b
SHA256

4af278d681249a1d292e0b0eb662f20ec919f984bf1c3d3ed0cff961fe0ef887
SHA512

72b2fb581a3e9efa8b9bde02507dce59a3e094fbc9d3c98701ce4ff5a37d152708a50c0b546232c073115e5e9988d9f3d7d33c1418d9fefa7c1236100d06deef
SSDEEP

12288:DcKn2SMgBEWoCruaOwVrf3iNWiPpq72IanrSy00kZlXa:DL6LmuZGf3ijBkMrSRzZRa

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

308 1760 WerFault.exe PAYMENT ADVICE.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

PAYMENT ADVICE.exe

description	pid	process	target process
PID 1760 wrote to memory of 308	1760	PAYMENT ADVICE.exe	WerFault.exe
PID 1760 wrote to memory of 308	1760	PAYMENT ADVICE.exe	WerFault.exe
PID 1760 wrote to memory of 308	1760	PAYMENT ADVICE.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\PAYMENT ADVICE.exe
"C:\Users\Admin\AppData\Local\Temp\PAYMENT ADVICE.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1760

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1760 -s 532
2⤵
- Program crash
PID:308

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/308-55-0x0000000000000000-mapping.dmp

Download
memory/1760-54-0x0000000001170000-0x00000000011EA000-memory.dmp

Filesize
488KB

Download