Analysis
- max time kernel
14s - max time network
102s - platform
windows10_x64 - resource
win10v20201028 - submitted
25/03/2021, 10:17
General
- Target Outstanding invoice-Pdf.exe
- Size 895KB
- Sample210325-bde8qfx396
- SHA256 b06ced28385c540bd07d0334529d5b66eac5db8965361e4391ad4a75798c8cb3
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Outstanding invoice-Pdf.exe"C:\Users\Admin\AppData\Local\Temp\Outstanding invoice-Pdf.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8 -s 11162⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/8-2-0x0000000073940000-0x000000007402E000-memory.dmp
memory/8-3-0x0000000000B50000-0x0000000000B51000-memory.dmp
memory/8-5-0x00000000059C0000-0x00000000059C1000-memory.dmp
memory/8-6-0x00000000054C0000-0x00000000054C1000-memory.dmp
memory/8-7-0x00000000054A0000-0x00000000054A1000-memory.dmp
memory/8-8-0x0000000005410000-0x0000000005411000-memory.dmp
memory/2140-9-0x0000000004CD0000-0x0000000004CD1000-memory.dmp
memory/2140-10-0x00000000050D0000-0x00000000050D1000-memory.dmp