Analysis
- max time kernel
61s - max time network
113s - platform
windows10_x64 - resource
win10 - submitted
18/08/2020, 13:16
General
- Target G.R.CORPORATION BANK SHEET.exe
- Size 362KB
- Sample200818-lcjp1vjnca
- SHA256 b8be0143a14abf58e652378a7206bd15705c7994e322d5e789e6f22b60b9dbdf
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\G.R.CORPORATION BANK SHEET.exe"C:\Users\Admin\AppData\Local\Temp\G.R.CORPORATION BANK SHEET.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3832 -s 11802⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3832-0-0x0000000073D70000-0x000000007445E000-memory.dmp
memory/3832-1-0x00000000005C0000-0x00000000005C1000-memory.dmp
memory/3832-3-0x0000000007790000-0x0000000007791000-memory.dmp
memory/3832-4-0x0000000007330000-0x0000000007331000-memory.dmp
memory/3832-5-0x0000000007320000-0x0000000007321000-memory.dmp
memory/3832-6-0x00000000096C0000-0x00000000096C1000-memory.dmp
memory/3832-7-0x0000000007550000-0x0000000007554000-memory.dmp
memory/4020-8-0x00000000048A0000-0x00000000048A1000-memory.dmp
memory/4020-10-0x0000000005150000-0x0000000005151000-memory.dmp