619be6954b3bd1d1e0859633fa23adca8241f832f942a671523b649c50a6d543 | Triage

Analysis

max time kernel
286s
max time network
340s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 18:26

Sharing

Report Analysis Logs

General

Target

file.exe
Size

1.5MB
MD5

f60b177577cfd6a61129cae027c7716b
SHA1

e10ca1c2a545bf868ea52361c442b0e88e33f987
SHA256

619be6954b3bd1d1e0859633fa23adca8241f832f942a671523b649c50a6d543
SHA512

5e07530165bb951a55cd60463e647492c5dc463a52fa0fab2a9e05ec833cfa0cc81649e60922791e1b2133e3819a18473d332bbe2db4898774c4e1e1f8759578
SSDEEP

24576:htBfMLD0dfWJIYZg9YPfIRhtHfVsmGk+oMJpIypPOhIVYQBuFDXn3Vf1+7I:h7Efng2I9+msoMHIypPFYQUL+7I

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4316	4620	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 4316	4620	file.exe	84
PID 4620 wrote to memory of 4316	4620	file.exe	84
PID 4620 wrote to memory of 4316	4620	file.exe	84

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 412
  2⤵
  - Program crash
  PID:4316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads