4cba59fde5a74d8e86638c65299b51adacc0ce2af56c1f17cb27c13bf5bb2263 | Triage

Analysis

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
31/01/2023, 21:01

Sharing

Report Analysis Logs

General

Target

Shipping Docs.exe
Size

18KB
MD5

f58167d0e2b3692dbac5b35b8907e414
SHA1

5cfaae6b595f0140ea0afa0f4e76ee23474edaae
SHA256

4cba59fde5a74d8e86638c65299b51adacc0ce2af56c1f17cb27c13bf5bb2263
SHA512

e5784c68b0145666b46117deb7276aa20c142306715180501ff9c91a574f7b4f3a2957924111728304a761f317cf63667bbcfa6cb4517cd445ed15736a91766d
SSDEEP

384:X2YZbVxZ4gddXpj3fIQS3l1Hok0NGHISSNZfTQL3:meowdN3sMpGKc7

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1340	1784	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 1340	1784	Shipping Docs.exe	28
PID 1784 wrote to memory of 1340	1784	Shipping Docs.exe	28
PID 1784 wrote to memory of 1340	1784	Shipping Docs.exe	28

C:\Users\Admin\AppData\Local\Temp\Shipping Docs.exe
"C:\Users\Admin\AppData\Local\Temp\Shipping Docs.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1784 -s 720
  2⤵
  - Program crash
  PID:1340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1784-54-0x0000000000F70000-0x0000000000F78000-memory.dmp

Filesize
32KB

Download
memory/1784-55-0x000007FEFC421000-0x000007FEFC423000-memory.dmp

Filesize
8KB

Download