4554d37ac18022aa4f7a3ad15f0175108a7d15645c1ee625df92d8042df96203 | Triage

Analysis

max time kernel
61s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
13-01-2023 18:48

Sharing

Report Analysis Logs

General

Target

file.exe
Size

3.5MB
MD5

e03131e486b1edd36a85c781c41d00f6
SHA1

26a492a6805b1d451d8cadd0f42f99a412d1c9f3
SHA256

4554d37ac18022aa4f7a3ad15f0175108a7d15645c1ee625df92d8042df96203
SHA512

2f0eea52bbf7d18b6b2ebf34c32deeb927dcd358f058297390fdc9adda6b6043408ca11de81e4f4a0d3f175d772748f6c008a1c531d5ec2939501fd1cf44817d
SSDEEP

98304:p3VEzCZpI57xHdgWCw1rBbOV/R2TU8TRbsLsiBP/UPuB7P7CbM5zD6sILTjblMSN:I6V/paRbsFs8i4osI3jhMSN

Score

6^/10

Malware Config

Signatures

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 ipinfo.io
14 api.db-ip.com
15 api.db-ip.com
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2408 4920 WerFault.exe file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 1216
2⤵
- Program crash
PID:2408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4920 -ip 4920
1⤵
PID:2576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...