Analysis
- max time kernel
149s - max time network
152s - platform
windows10_x64 - resource
win10 - submitted
14/10/2020, 15:11
General
- Target ORDER_REQUEST09467_PDF.exe
- Size 1.1MB
- Sample201014-azqp421w8e
- SHA256 1971656a7db56f7e14d9f95176b44d0a51deb967bc68dd7b2b8efedb65c76296
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ORDER_REQUEST09467_PDF.exe"C:\Users\Admin\AppData\Local\Temp\ORDER_REQUEST09467_PDF.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3892 -s 11602⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2812-10-0x0000000005000000-0x0000000005001000-memory.dmp
memory/3892-0-0x00000000734C0000-0x0000000073BAE000-memory.dmp
memory/3892-1-0x0000000000580000-0x0000000000581000-memory.dmp
memory/3892-3-0x0000000004F20000-0x0000000004F21000-memory.dmp
memory/3892-4-0x0000000005530000-0x0000000005531000-memory.dmp
memory/3892-5-0x0000000005030000-0x0000000005031000-memory.dmp
memory/3892-6-0x0000000002B60000-0x0000000002B61000-memory.dmp
memory/3892-7-0x0000000005190000-0x0000000005191000-memory.dmp
memory/3892-8-0x0000000005A30000-0x0000000006230000-memory.dmp
memory/3892-9-0x0000000006680000-0x000000000670C000-memory.dmp