Analysis
- max time kernel
110s - max time network
110s - platform
windows10_x64 - resource
win10v20210408 - submitted
22/04/2021, 16:43
General
- Target ef33f7a8cc10b0b8bc636eb8c751f85f.exe
- Size 708KB
- Sample210422-ccbfephp96
- SHA256 87333ef0fa9e3210c9709eb296c413dfe6643eb8bdedf9f8ad1da0ee31da7300
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef33f7a8cc10b0b8bc636eb8c751f85f.exe"C:\Users\Admin\AppData\Local\Temp\ef33f7a8cc10b0b8bc636eb8c751f85f.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 11322⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/640-114-0x0000000000380000-0x0000000000381000-memory.dmp
memory/640-116-0x0000000004D40000-0x0000000004D41000-memory.dmp
memory/640-117-0x00000000052E0000-0x00000000052E1000-memory.dmp
memory/640-118-0x0000000004DE0000-0x0000000004DE1000-memory.dmp
memory/640-119-0x0000000002750000-0x0000000002751000-memory.dmp
memory/640-120-0x0000000004D20000-0x0000000004D21000-memory.dmp
memory/640-121-0x0000000004F10000-0x0000000004F11000-memory.dmp
memory/640-122-0x00000000057E0000-0x00000000057E9000-memory.dmp