Analysis
- max time kernel
22s - max time network
119s - platform
windows10_x64 - resource
win10v20210408 - submitted
12/04/2021, 12:05
General
- Target 89736782464672.bat.exe
- Size 14KB
- Sample210412-jtpl5s3cb2
- SHA256 544ac4195d8b23df9768ca5d3fa2afe2d43e7f3ff2001c6eca07f8a68fbc2f7d
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\89736782464672.bat.exe"C:\Users\Admin\AppData\Local\Temp\89736782464672.bat.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 18202⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4032-114-0x0000000000590000-0x0000000000591000-memory.dmp
memory/4032-116-0x0000000004E20000-0x0000000004E21000-memory.dmp
memory/4032-117-0x0000000006960000-0x0000000006961000-memory.dmp
memory/4032-118-0x0000000002680000-0x00000000026CF000-memory.dmp