7a1f126caa7226f2afffb5063b395d288a794823b61f8611003a49e45036d000 | Triage

Analysis

max time kernel
126s
max time network
133s
platform
windows7_x64
resource
win7
submitted
09-07-2020 13:43

Sharing

Report Analysis Logs

General

Target

7a1f126caa7226f2afffb5063b395d288a794823b61f8611003a49e45036d000.exe
Size

6KB
MD5

a03b607d50c407ade12a684046a5f079
SHA1

f986c87f66350401fa807c66bd8f91ce82683c25
SHA256

7a1f126caa7226f2afffb5063b395d288a794823b61f8611003a49e45036d000
SHA512

dfa61f0ace4b8fa198b90de0f4675a4476fef6316bf486b12c0927045780af775a0cc731e343c235476b8bc355ffc705425debdc12e94c5052f77c0d531fc669

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1424 1164 WerFault.exe 7a1f126caa7226f2afffb5063b395d288a794823b61f8611003a49e45036d000.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

7a1f126caa7226f2afffb5063b395d288a794823b61f8611003a49e45036d000.exe

description	pid	process	target process
PID 1164 wrote to memory of 1424	1164	7a1f126caa7226f2afffb5063b395d288a794823b61f8611003a49e45036d000.exe	WerFault.exe
PID 1164 wrote to memory of 1424	1164	7a1f126caa7226f2afffb5063b395d288a794823b61f8611003a49e45036d000.exe	WerFault.exe
PID 1164 wrote to memory of 1424	1164	7a1f126caa7226f2afffb5063b395d288a794823b61f8611003a49e45036d000.exe	WerFault.exe
PID 1164 wrote to memory of 1424	1164	7a1f126caa7226f2afffb5063b395d288a794823b61f8611003a49e45036d000.exe	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1424 WerFault.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1424 WerFault.exe
1424 WerFault.exe
1424 WerFault.exe
1424 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1424 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\7a1f126caa7226f2afffb5063b395d288a794823b61f8611003a49e45036d000.exe
"C:\Users\Admin\AppData\Local\Temp\7a1f126caa7226f2afffb5063b395d288a794823b61f8611003a49e45036d000.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 632
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1424-0-0x0000000000000000-mapping.dmp

Download
memory/1424-1-0x0000000001DF0000-0x0000000001E01000-memory.dmp

Filesize
68KB

Download
memory/1424-2-0x00000000025C0000-0x00000000025D1000-memory.dmp

Filesize
68KB

Download