e583660bcc37e8047847dec5a26acc450d04d2e84f931042b97a91f3c4e13372 | Triage

Analysis

max time kernel
29s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-02-2023 14:33

Sharing

Report Analysis Logs

General

Target

unmined.exe
Size

53.8MB
MD5

68367a5591699951093ad84466e5b58d
SHA1

65c922cfb33ad23380773302e28ec6f74a29ade1
SHA256

e583660bcc37e8047847dec5a26acc450d04d2e84f931042b97a91f3c4e13372
SHA512

f418f0b248e0f30e13b35c87f2c005d015b5d13e27864598bcdbafda14d4a921facb5e7776228471648d074279681bfa1d42934a5d897030177a0929cdef399e
SSDEEP

786432:UOYd4rdGd/mGyfDWcaMX0sy7hB9DaNUO+:UqrumGIWcaMX0DO+

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1544 1280 WerFault.exe unmined.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

unmined.exe

description	pid	process	target process
PID 1280 wrote to memory of 1544	1280	unmined.exe	WerFault.exe
PID 1280 wrote to memory of 1544	1280	unmined.exe	WerFault.exe
PID 1280 wrote to memory of 1544	1280	unmined.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\unmined.exe
"C:\Users\Admin\AppData\Local\Temp\unmined.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1280

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1280 -s 836
2⤵
- Program crash
PID:1544

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1544-54-0x0000000000000000-mapping.dmp

Download