355dc4adaf2368f0e4dd306a8840dc0d2ff0e9c0768d0974b2f13ae3737a6168 | Triage

Analysis

max time kernel
159s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01-01-2024 12:31

Sharing

Report Analysis Logs

General

Target

out.exe
Size

3.0MB
MD5

f2d895ce3167efb3ad556c38dc51f1f7
SHA1

54ba4af15c785e76bde958f89cc13accbb03ad15
SHA256

ca6f11f858b378d959b99fea0edc4d89d0340bbcbc79e9829bb82072cb5bc0c7
SHA512

df207645f5e565f0030842938f7d4a45b7b3751499871e9bab79fe1a25697e0721e49fee7aad6295509e45c2a0534a562cee97a47e1621bb06a526031d7bd7bf
SSDEEP

49152:9egAQ+Yg8sxmXXxQjiQspGXtwB0pnk57TosNjLSq6Pq3Ecv9dsiPTg3pg1:9egAQ+YBQeQVmB0pni7TosNKq6adsi

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	Process	procid_target
1528	2528	WerFault.exe	87
3540	2528	WerFault.exe	87

C:\Users\Admin\AppData\Local\Temp\out.exe
"C:\Users\Admin\AppData\Local\Temp\out.exe"
1⤵
PID:2528
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 220
  2⤵
  - Program crash
  PID:1528
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 224
  2⤵
  - Program crash
  PID:3540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2528 -ip 2528
1⤵
PID:4672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2528 -ip 2528
1⤵
PID:4164

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads