Analysis
-
max time kernel
88s -
max time network
115s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
15-03-2021 09:49
General
-
Target
38ee6bea62658ae4fa75914261a5848a8db5b332ddfb52daf01e958871559e15.exe
-
Size
1.6MB
-
MD5
7feccbef4ed3a323ed763d24d022e4df
-
SHA1
c6d62240ffd19c94a5f5080d7518b65555eb4fb2
-
SHA256
38ee6bea62658ae4fa75914261a5848a8db5b332ddfb52daf01e958871559e15
-
SHA512
ccb1b77974fb1be74fc71f3f6d036aafdf077d214efadd933f8e3f7e4e9e9f4e8915d9d4da31b95a65e15c29429a726aa3d3116fbb4f2b73c3fa95ddc78d22e2
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\38ee6bea62658ae4fa75914261a5848a8db5b332ddfb52daf01e958871559e15.exe"C:\Users\Admin\AppData\Local\Temp\38ee6bea62658ae4fa75914261a5848a8db5b332ddfb52daf01e958871559e15.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 652 -s 14322⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/420-7-0x000002B68E8E0000-0x000002B68E8E1000-memory.dmpFilesize
4KB
-
memory/652-2-0x00007FFA01970000-0x00007FFA0235C000-memory.dmpFilesize
9.9MB
-
memory/652-3-0x0000000000170000-0x0000000000171000-memory.dmpFilesize
4KB
-
memory/652-5-0x0000000000710000-0x0000000000711000-memory.dmpFilesize
4KB
-
memory/652-6-0x000000001AF90000-0x000000001AF92000-memory.dmpFilesize
8KB