31307fd48576c3d1a61fbc70e6f7a63d39d903dea4b1a8d47089ad15ce3632a6 | Triage

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 18:44

Sharing

Report Analysis Logs

General

Target

Bypass-Tools/fg679p2.exe
Size

498KB
MD5

6a606cbdb8860ff486656e6b8ce786d4
SHA1

8513e29b1844c086d3fa3ae3d1d2169f5378a96a
SHA256

cb0d4788d6382a032c50c503fef59e8625affc65ec7aef0cdd4bf89221d57f38
SHA512

0badea06710b5413e8ad5f8dcc6dcb5785bed5428977de6d42a56a9729fd26b2b61f0f2ea5c049a0d0c9213560954fe669c35b9760a16466edc9ad0a83b597b2
SSDEEP

12288:mqAYK1RQmJc+1yedZOSQOs7YNCS+nGxcz2+aQTJw/XfPJI:xzmRQmJPyei/Sx+PTuB

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4884 3020 WerFault.exe fg679p2.exe

C:\Users\Admin\AppData\Local\Temp\Bypass-Tools\fg679p2.exe
"C:\Users\Admin\AppData\Local\Temp\Bypass-Tools\fg679p2.exe"
1⤵
PID:3020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 344
2⤵
- Program crash
PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3020 -ip 3020
1⤵
PID:4124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...