Analysis
-
max time kernel
63s -
max time network
124s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
13-01-2021 14:58
General
-
Target
FYI.exe
-
Size
909KB
-
MD5
4768fad22f989c9ac940775ca46f91f6
-
SHA1
78f2e47fbcd50d77b8c0ea5e07209a2b1a79c45e
-
SHA256
275b79db451178b96e4872f9164b8b89f25a5f22ff8ba5f983d555cb3972a95d
-
SHA512
74d822b0b1374af9f53b603c145a58482b843aab9fcab43f1c64cc7c4ab6d189998d1964ad2e300d52f124d827175aaea3e3f78a836d07906a703997b5a8ad52
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\FYI.exe"C:\Users\Admin\AppData\Local\Temp\FYI.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 11682⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/640-2-0x0000000073DC0000-0x00000000744AE000-memory.dmpFilesize
6.9MB
-
memory/640-3-0x0000000000BF0000-0x0000000000BF1000-memory.dmpFilesize
4KB
-
memory/640-5-0x0000000005BD0000-0x0000000005BD1000-memory.dmpFilesize
4KB
-
memory/640-6-0x00000000056D0000-0x00000000056D1000-memory.dmpFilesize
4KB
-
memory/640-7-0x0000000005770000-0x0000000005771000-memory.dmpFilesize
4KB
-
memory/640-8-0x0000000005640000-0x0000000005641000-memory.dmpFilesize
4KB
-
memory/640-9-0x00000000058D0000-0x00000000058E2000-memory.dmpFilesize
72KB
-
memory/640-10-0x0000000006480000-0x00000000064F2000-memory.dmpFilesize
456KB
-
memory/3516-11-0x00000000041C0000-0x00000000041C1000-memory.dmpFilesize
4KB