11c6b253aaede403287e3ba93412a1e09820a642171551346c3548cb9bf603c2 | Triage

Analysis

max time kernel
97s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2023, 09:02

Sharing

Report Analysis Logs

General

Target

PlusERP.exe
Size

7.1MB
MD5

f754f2405097b1f4b181a56e0c2cdaf2
SHA1

852f4fc54f3815b8997b072f74a03b401d0eab1e
SHA256

11c6b253aaede403287e3ba93412a1e09820a642171551346c3548cb9bf603c2
SHA512

7c014e06ef5d6e38a6e6174a4966682cc6f21309a2fe0390b9fc7f881c651ff97dcf53b7e7c04509e807dfacdffe313852c27ac2d813cdbadc95787e3e24ca44
SSDEEP

196608:2Pza57yWAmOfAh6a/ZvdWcen/BJXmRM1mkt:22yWApWo3pJgM1N

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2956	1304	WerFault.exe	83

C:\Users\Admin\AppData\Local\Temp\PlusERP.exe
"C:\Users\Admin\AppData\Local\Temp\PlusERP.exe"
1⤵
PID:1304
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 1252
  2⤵
  - Program crash
  PID:2956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 1304 -ip 1304
1⤵
PID:1412

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1304-133-0x0000000000F90000-0x00000000016A6000-memory.dmp

Filesize
7.1MB

Download
memory/1304-134-0x0000000003AB0000-0x0000000003AC0000-memory.dmp

Filesize
64KB

Download