Overview

overview

3

Static

static

622070f03e...78.exe

windows7_x64

3

622070f03e...78.exe

windows10_x64

3

Analysis

  • max time kernel
    52s
  • max time network
    21s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    09-07-2020 12:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    622070f03ea5a66037c38715ecce1ca6351148ab56ce6423fdafc13b383a4878.exe

  • Size

    6KB

  • MD5

    7783211ed125bbe31cf50b47e9e96fbb

  • SHA1

    b6b9c5effdd14e2920183b313c56e5068c57a709

  • SHA256

    622070f03ea5a66037c38715ecce1ca6351148ab56ce6423fdafc13b383a4878

  • SHA512

    9cebeb2eecc58edd86370e4967905f90655e6f4c6dad982f659c9ab2bf05ceb285d07bc21abbb8d0607566225bbb2e97366eda5bb40091a6b468227ea319f30c

Score
3/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\622070f03ea5a66037c38715ecce1ca6351148ab56ce6423fdafc13b383a4878.exe
    "C:\Users\Admin\AppData\Local\Temp\622070f03ea5a66037c38715ecce1ca6351148ab56ce6423fdafc13b383a4878.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1100
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 540
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      PID:820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/820-0-0x0000000000000000-mapping.dmp
    Download
  • memory/820-1-0x0000000002140000-0x0000000002151000-memory.dmp
    Filesize

    68KB

    Download
  • memory/820-2-0x00000000025D0000-0x00000000025E1000-memory.dmp
    Filesize

    68KB

    Download