Analysis
- max time kernel
111s - max time network
111s - platform
windows10_x64 - resource
win10v20210408 - submitted
22/04/2021, 16:45
General
- Target ac0e6d08a5c501932ae5eea36000e7d1.exe
- Size 557KB
- Sample210422-dsmgsfbvjs
- SHA256 f1e27e0dbf418da288b43f2dd8bd89f494558fa4ffa12ad1ba8e8cabe9f47c7d
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac0e6d08a5c501932ae5eea36000e7d1.exe"C:\Users\Admin\AppData\Local\Temp\ac0e6d08a5c501932ae5eea36000e7d1.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 852 -s 11362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/852-114-0x0000000000580000-0x0000000000581000-memory.dmp
memory/852-116-0x0000000004E00000-0x0000000004E01000-memory.dmp
memory/852-117-0x00000000053D0000-0x00000000053D1000-memory.dmp
memory/852-118-0x0000000004F70000-0x0000000004F71000-memory.dmp
memory/852-119-0x0000000004ED0000-0x0000000004ED1000-memory.dmp
memory/852-120-0x0000000005190000-0x0000000005191000-memory.dmp
memory/852-121-0x0000000004ED0000-0x00000000053CE000-memory.dmp
memory/852-122-0x0000000005280000-0x0000000005289000-memory.dmp