Analysis
- max time kernel
103s - max time network
113s - platform
windows10_x64 - resource
win10v20210410 - submitted
06/06/2021, 06:58
General
- Target 6a52df7334fbf67c1013655b8b96849a.exe
- Size 497KB
- Sample210606-rlhr18d9fs
- SHA256 b319860458d9f2cf6d8a43e3afa5d71b2a84cf408f2d0e104804ada090abf027
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a52df7334fbf67c1013655b8b96849a.exe"C:\Users\Admin\AppData\Local\Temp\6a52df7334fbf67c1013655b8b96849a.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3204 -s 10882⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3204-114-0x0000000000B40000-0x0000000000B41000-memory.dmp
memory/3204-116-0x0000000005400000-0x0000000005401000-memory.dmp
memory/3204-117-0x00000000059D0000-0x00000000059D1000-memory.dmp
memory/3204-118-0x0000000005570000-0x0000000005571000-memory.dmp
memory/3204-119-0x00000000053D0000-0x00000000053D1000-memory.dmp
memory/3204-120-0x0000000005700000-0x0000000005701000-memory.dmp
memory/3204-121-0x0000000005550000-0x0000000005564000-memory.dmp
memory/3204-122-0x00000000054D0000-0x00000000059CE000-memory.dmp