Overview

overview

10

Static

static

Document#0193832.exe

windows7_x64

10

Document#0193832.exe

windows10_x64

3

Analysis

  • max time kernel
    128s
  • max time network
    132s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    31-07-2020 12:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Document#0193832.exe

  • Size

    1.1MB

  • MD5

    97edaeff8f726e10d554f8f8f5aad7ae

  • SHA1

    01da166b48252cfb52ad7b42730ec994f07c7db2

  • SHA256

    bcd7372fd84fe78e97a72a842df6cab2a5d7a47909a3fd05b13f6f4990de8a7f

  • SHA512

    99ca75b3989909eb66f2c7cd282db81c2c952fbf637287c6157df923335f5f9bd63b9d5b91b0ec7de06d68391903f716f5ab6ce67f2f3230a3e8c25b44aa5f16

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Document#0193832.exe
    "C:\Users\Admin\AppData\Local\Temp\Document#0193832.exe"
    1⤵
      PID:3044
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 1184
        2⤵
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious behavior: EnumeratesProcesses
        PID:3796

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3796-0-0x00000000049A0000-0x00000000049A1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3796-1-0x00000000049A0000-0x00000000049A1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3796-3-0x0000000004DA0000-0x0000000004DA1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/3796-4-0x00000000051A0000-0x00000000051A1000-memory.dmp
      Filesize

      4KB

      Download