863907db2703e6650d2e9341ab975e67f889cbb4f8efba089cf421295bb100d1 | Triage

Analysis

max time kernel
284s
max time network
357s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
09-02-2023 09:31

Sharing

Report Analysis Logs

General

Target

file.exe
Size

3.5MB
MD5

5d69e6efaab3c2ad8136038108de1a4f
SHA1

22d1bea7ae38e09b45b0090df91e0f1fec0559ba
SHA256

863907db2703e6650d2e9341ab975e67f889cbb4f8efba089cf421295bb100d1
SHA512

cdec194a1028903db806fad4471374a9a01dffcba938e7b7253caf9e671e3feb63b2f35d75d2d1582592bad007efdc5f3f03d42c17c528d46105ea26e539f542
SSDEEP

98304:AqNHddSy2xT3SJ0vsw4AHCJpV/82TJNK+gT9/69CzFh7P7CbM5zD6sILTjblMS0u:rjV/pNK+gMwzbi4osI3jhMSN

Score

6^/10

Malware Config

Signatures

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

26 ipinfo.io
43 api.db-ip.com
44 api.db-ip.com
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4736 1208 WerFault.exe file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
PID:1208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1208 -s 1200
2⤵
- Program crash
PID:4736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1208 -ip 1208
1⤵
PID:3472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...