adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c | Triage

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
23-03-2023 13:03

Sharing

Report Analysis Logs

General

Target

file.exe
Size

1.9MB
MD5

ffc87cf5de85e0a6a3941bc91780d928
SHA1

6029ea950091d269d9626343a8defefd1b6c5c1c
SHA256

adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c
SHA512

98a8f5b8073267e1435a7df8bbc2249f226cb82cda16a18a4e8525d8b068f93aeeca577cff3faf2bacda4493028ae4232189ba98c22883ec9face8cd29105556
SSDEEP

49152:XKcEqlms7r6WKt3iS/rmEPM/u0iEV9IHuxJxruCD:66lms3a3iS/rmOMVVqHuvYCD

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1952 1992 WerFault.exe file.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

file.exe

description	pid	process	target process
PID 1992 wrote to memory of 1952	1992	file.exe	WerFault.exe
PID 1992 wrote to memory of 1952	1992	file.exe	WerFault.exe
PID 1992 wrote to memory of 1952	1992	file.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1992

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1992 -s 628
2⤵
- Program crash
PID:1952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1992-54-0x0000000000E50000-0x000000000103E000-memory.dmp

Filesize
1.9MB

Download
memory/1992-55-0x000000001BF10000-0x000000001BF90000-memory.dmp

Filesize
512KB

Download
memory/1992-56-0x000000001C090000-0x000000001C22E000-memory.dmp

Filesize
1.6MB

Download