b411fa289b897c774560292abcf7c298e29e1b9b8243357b1cc7d25a28622739 | Triage

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-04-2024 04:56

Sharing

Report Analysis Logs

General

Target

launcher.exe
Size

25.4MB
MD5

913b4744fbcd88cbc9ba44808a835a91
SHA1

d5cb6cbe5d4ad8b20a351080a6bc8e85fa72a64e
SHA256

b411fa289b897c774560292abcf7c298e29e1b9b8243357b1cc7d25a28622739
SHA512

ab0c1ec3840947262d4825bbc1cb1f0f056fceda99d7886ce7f83c432faf91a89e17f81e21132a9f997a895c0dd3cdb3d987b47608020cb1260657d782847863
SSDEEP

12288:5R5ouJIVQhcEWuDG6X/ob2qlTIiw/TmQxFZpC:dnJIG2EFlf09GTmYvC

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2100 2896 WerFault.exe launcher.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

launcher.exe

description	pid	process	target process
PID 2896 wrote to memory of 2100	2896	launcher.exe	WerFault.exe
PID 2896 wrote to memory of 2100	2896	launcher.exe	WerFault.exe
PID 2896 wrote to memory of 2100	2896	launcher.exe	WerFault.exe
PID 2896 wrote to memory of 2100	2896	launcher.exe	WerFault.exe
PID 2896 wrote to memory of 2100	2896	launcher.exe	WerFault.exe
PID 2896 wrote to memory of 2100	2896	launcher.exe	WerFault.exe
PID 2896 wrote to memory of 2100	2896	launcher.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\launcher.exe
"C:\Users\Admin\AppData\Local\Temp\launcher.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 200
  2⤵
  - Program crash
  PID:2100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2896-0-0x0000000000980000-0x00000000009F4000-memory.dmp

Filesize
464KB

Download