Analysis

  • max time kernel
    115s
  • max time network
    114s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    12-05-2021 19:34

General

  • Target

    1667e1635736f2b2ba9727457f995a67201ddcd818496c9296713ffa18e17a43.exe

  • Size

    40KB

  • MD5

    1a700f845849e573ab3148daef1a3b0b

  • SHA1

    c91ff86a88038b00d9190ebb01e6f8c94b0c83e0

  • SHA256

    1667e1635736f2b2ba9727457f995a67201ddcd818496c9296713ffa18e17a43

  • SHA512

    d7fcf0ef26bbe1d6104c098711ccdfd33655e62045f6975dd3c48ab34888c83b771dfd07682004943bab86b2dbcb7905364becead09c37de3da0b28e8265dc81

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1667e1635736f2b2ba9727457f995a67201ddcd818496c9296713ffa18e17a43.exe
    "C:\Users\Admin\AppData\Local\Temp\1667e1635736f2b2ba9727457f995a67201ddcd818496c9296713ffa18e17a43.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1092
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 36
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      PID:2012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2012-60-0x0000000000000000-mapping.dmp

  • memory/2012-61-0x00000000753B1000-0x00000000753B3000-memory.dmp

    Filesize

    8KB

  • memory/2012-62-0x0000000000470000-0x0000000000471000-memory.dmp

    Filesize

    4KB