cc3635e8f69d39427f470f0c6a687e88ea006c70077601177dd0852778d2ad08 | Triage

Analysis

max time kernel
123s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 05:45

Sharing

Report Analysis Logs

General

Target

G_Client.exe
Size

827KB
MD5

56bebeecc213c2cd6bfe37679ebf1645
SHA1

54c661267b4dc1b6553ca1a49043a13fb13c4ee9
SHA256

bfebd4407e311f16db8b99f06429fa358311e5eb555d2565c3494cf90d9081df
SHA512

9cb57d4eb59403b8c70c6b630d1588e928b7ca3321023309efb171df2284308161bfbdbfadc6f6fe63a637385431da6a6a418401c613f41bd2bbcc71e0def12c
SSDEEP

12288:vzFCPb3dtAb6uZovzf/FvzzI38jwZzN86zXxlYzGgSqsNy2anwWh5A:vzWtt1uZovz37jDCPYzGg4u3

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4656	5024	WerFault.exe	88
3040	5024	WerFault.exe	88

C:\Users\Admin\AppData\Local\Temp\G_Client.exe
"C:\Users\Admin\AppData\Local\Temp\G_Client.exe"
1⤵
PID:5024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 496
  2⤵
  - Program crash
  PID:4656
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 504
  2⤵
  - Program crash
  PID:3040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5024 -ip 5024
1⤵
PID:1220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5024 -ip 5024
1⤵
PID:4992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5024-0-0x0000000000400000-0x0000000000572000-memory.dmp

Filesize
1.4MB

Download
memory/5024-1-0x0000000000400000-0x0000000000572000-memory.dmp

Filesize
1.4MB

Download