Analysis
- max time kernel
99s - max time network
102s - platform
windows7_x64 - resource
win7 - submitted
14/10/2020, 15:23
General
- Target Swift00115511.Scan.pdf..exe
- Size 738KB
- Sample201014-1b627jqen2
- SHA256 ef5dbe682ac76e5ce2f3144de2a4df1ded4094e982dcf22f6354a77bcb39b152
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Swift00115511.Scan.pdf..exe"C:\Users\Admin\AppData\Local\Temp\Swift00115511.Scan.pdf..exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 6682⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1124-0-0x0000000073BD0000-0x00000000742BE000-memory.dmp
memory/1124-1-0x0000000000270000-0x0000000000271000-memory.dmp
memory/1124-3-0x0000000004E10000-0x0000000005610000-memory.dmp
memory/1124-4-0x0000000005D00000-0x0000000005D75000-memory.dmp
memory/1624-6-0x0000000002200000-0x0000000002211000-memory.dmp
memory/1624-7-0x0000000002A00000-0x0000000002A11000-memory.dmp