44603ac8b9cfa164c77c3d97cab92f890b466514d14e94b516a6b903859d0f41 | Triage

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2024, 22:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ArmDot Trial Bypass.exe
Size

6KB
MD5

ae06fd4cde97f7bfa287ee3a3760ca18
SHA1

5eb1bf23168ba22e04d051c64f76d6ac8ce2c2b9
SHA256

44603ac8b9cfa164c77c3d97cab92f890b466514d14e94b516a6b903859d0f41
SHA512

629d7bfc1c5c5ede975dde3978fcde8497e21d09b7ab6006e96ec044bf8fc4590c63c38653253c7cc7242ecb4067efd134f7bfd593d2747eddcad802dd37d703
SSDEEP

96:eZfne+rWhsa0emt/XfwZsYC/uyTB7uHKRXRCtGzNt:IfnOsaHmhXf+CX1SKD0A

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
332	3820	WerFault.exe	82

C:\Users\Admin\AppData\Local\Temp\ArmDot Trial Bypass.exe
"C:\Users\Admin\AppData\Local\Temp\ArmDot Trial Bypass.exe"
1⤵
PID:3820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3820 -s 872
  2⤵
  - Program crash
  PID:332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3820 -ip 3820
1⤵
PID:3380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3820-0-0x000000007529E000-0x000000007529F000-memory.dmp

Filesize
4KB

Download
memory/3820-1-0x00000000009E0000-0x00000000009E8000-memory.dmp

Filesize
32KB

Download