8f9648879a2d781dbb8390f7b5b0eea36201fbf15a02b0c5d374271dd211bbdf | Triage

Analysis

max time kernel
90s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10-03-2024 22:59

Sharing

Report Analysis Logs

General

Target

bf2e8493970a57649cec55d38f5a542b.exe
Size

457KB
MD5

bf2e8493970a57649cec55d38f5a542b
SHA1

4b515de9d55f7201c19fe177ea7a4de4569221ae
SHA256

8f9648879a2d781dbb8390f7b5b0eea36201fbf15a02b0c5d374271dd211bbdf
SHA512

9c835b7b78adbfa6950eb5c400a924fe714a64a19fdf67d48a940f2f65d0c0e2b4394192f4d6b3e777a5e992c561082dcd2d516b0e37860a89b2e158cde18509
SSDEEP

12288:OGKE6iuzAoYSrQb5lAA7OZBq7yeIGa6cA3l:OcxuSbUVWcI

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1020 3956 WerFault.exe bf2e8493970a57649cec55d38f5a542b.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

bf2e8493970a57649cec55d38f5a542b.exe

description	pid	process	target process
PID 3956 wrote to memory of 348	3956	bf2e8493970a57649cec55d38f5a542b.exe	bf2e8493970a57649cec55d38f5a542b.exe
PID 3956 wrote to memory of 348	3956	bf2e8493970a57649cec55d38f5a542b.exe	bf2e8493970a57649cec55d38f5a542b.exe
PID 3956 wrote to memory of 348	3956	bf2e8493970a57649cec55d38f5a542b.exe	bf2e8493970a57649cec55d38f5a542b.exe

C:\Users\Admin\AppData\Local\Temp\bf2e8493970a57649cec55d38f5a542b.exe
"C:\Users\Admin\AppData\Local\Temp\bf2e8493970a57649cec55d38f5a542b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3956

C:\Users\Admin\AppData\Local\Temp\bf2e8493970a57649cec55d38f5a542b.exe
"C:\Users\Admin\AppData\Local\Temp\bf2e8493970a57649cec55d38f5a542b.exe"
2⤵
PID:348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 408
2⤵
- Program crash
PID:1020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3956 -ip 3956
1⤵
PID:4592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3956-1-0x00000000000A0000-0x00000000001A0000-memory.dmp

Filesize
1024KB

Download
memory/3956-2-0x0000000000450000-0x0000000000452000-memory.dmp

Filesize
8KB

Download