202a9c874e794f55e31ef038652d20e16672372539c71394ddeda724deb3a3ab | Triage

Analysis

max time kernel
496s
max time network
499s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2022 02:09

Sharing

Report Analysis Logs

General

Target

nppshell.exe
Size

2.1MB
MD5

14babf2e06fda6c120cbe98c0746a984
SHA1

57ccbb753fa2a6ea8e6f45c1ced3326404969b04
SHA256

202a9c874e794f55e31ef038652d20e16672372539c71394ddeda724deb3a3ab
SHA512

20917024c4ae78de051457d65a7f4d192542bea4aab39dc289c71e92a578fc353e396d95c6a3a5001c6480c040ce735b2d4550820a8b1fa092afdbf0c45a1e57
SSDEEP

49152:0Dv5ESHLhxCaOAJpMG5uozbf1T8zhNjox1l5fr3Wyx2:++CL7TOAJ2G5uoNT5x1bfr3nQ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4944 4260 WerFault.exe nppshell.exe

C:\Users\Admin\AppData\Local\Temp\nppshell.exe
"C:\Users\Admin\AppData\Local\Temp\nppshell.exe"
1⤵
PID:4260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 244
2⤵
- Program crash
PID:4944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4260 -ip 4260
1⤵
PID:3448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4260-132-0x0000000000400000-0x00000000009EF000-memory.dmp

Filesize
5.9MB

Download
memory/4260-133-0x0000000000400000-0x00000000009EF000-memory.dmp

Filesize
5.9MB

Download