f0a9d503509470f599b556e880214e67481431c2b1358f6372666b6c1d386114 | Triage

Analysis

max time kernel
27s
max time network
17s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30-05-2024 05:02

Sharing

Report Analysis Logs

General

Target

MultiFaceRec.exe
Size

29KB
MD5

6abf86b1ee45a13a15705384d2ee3e66
SHA1

b0344c5e6de97267bb9a624cb61d4c5ac64cad0f
SHA256

f0a9d503509470f599b556e880214e67481431c2b1358f6372666b6c1d386114
SHA512

fc1180e33b5588283b3aa09cdbdb4d2d220882f5756df17de52981794028713c270d919aa56925712b11d9094de8d3279e27bbbbe0feddc4e9b272f2817cc61b
SSDEEP

768:te9rYBXoVv3MZHaDKJ9res7cBn9aqkz1d:twbf4xJzTqkRd

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1684	1096	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 1684	1096	MultiFaceRec.exe	28
PID 1096 wrote to memory of 1684	1096	MultiFaceRec.exe	28
PID 1096 wrote to memory of 1684	1096	MultiFaceRec.exe	28
PID 1096 wrote to memory of 1684	1096	MultiFaceRec.exe	28

C:\Users\Admin\AppData\Local\Temp\MultiFaceRec.exe
"C:\Users\Admin\AppData\Local\Temp\MultiFaceRec.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 548
  2⤵
  - Program crash
  PID:1684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1096-0-0x0000000074B1E000-0x0000000074B1F000-memory.dmp

Filesize
4KB

Download
memory/1096-1-0x0000000000920000-0x000000000092E000-memory.dmp

Filesize
56KB

Download
memory/1096-2-0x0000000074B1E000-0x0000000074B1F000-memory.dmp

Filesize
4KB

Download