8a33cc7af2cf926411f45236cb841d1b5ab667aabff7c85c102a0edb2baa2534 | Triage

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14-05-2023 00:53

Sharing

Report Analysis Logs

General

Target

ref/Ruler.IRule.exe
Size

19KB
MD5

53219a941c35e570766d68b006e564da
SHA1

3e30428a2b0b355244250707222d0fe3e1120de5
SHA256

d71d16e27a2588d571b9fb5d363d8d0fc21cdb9c7147cd62a1fa3d2965d7d3ca
SHA512

f6f892bf6dca0c0170151331d02c7593c51cbf2a2b1263f590820ad01622aa289c03b9c9c837c3a429cb9d5099d7807e9ade80037b285549a1d15ce171754ff4
SSDEEP

192:goJtxMHb92e7PSjNtB2vwAbKBrJFEgG81V:g0xM7QOsNtCKBf

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

940 1316 WerFault.exe Ruler.IRule.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Ruler.IRule.exe

description	pid	process	target process
PID 1316 wrote to memory of 940	1316	Ruler.IRule.exe	WerFault.exe
PID 1316 wrote to memory of 940	1316	Ruler.IRule.exe	WerFault.exe
PID 1316 wrote to memory of 940	1316	Ruler.IRule.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ref\Ruler.IRule.exe
"C:\Users\Admin\AppData\Local\Temp\ref\Ruler.IRule.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1316

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1316 -s 488
2⤵
- Program crash
PID:940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1316-54-0x0000000000F00000-0x0000000000F0C000-memory.dmp

Filesize
48KB

Download