Analysis
- max time kernel
91s - max time network
104s - platform
windows10_x64 - resource
win10 - submitted
29/07/2020, 06:22
General
- Target NEW837 PO3.exe
- Size 970KB
- Sample200729-tc2vxvy4te
- SHA256 824f3b6b2f801742c68deb29ccf2347f591c5d04262dc1ad9efcb756be99ea25
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEW837 PO3.exe"C:\Users\Admin\AppData\Local\Temp\NEW837 PO3.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 11882⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3780-2-0x0000000005080000-0x0000000005081000-memory.dmp
memory/3780-3-0x0000000005080000-0x0000000005081000-memory.dmp
memory/3780-5-0x00000000058B0000-0x00000000058B1000-memory.dmp
memory/4004-1-0x00000000083D0000-0x00000000083E0000-memory.dmp