Analysis
- max time kernel
13s - max time network
135s - platform
windows10_x64 - resource
win10v20210410 - submitted
22/06/2021, 19:10
General
- Target 003401d84fe2783f9f2658743d8635f9.exe
- Size 996KB
- Sample210622-lk21txs3ps
- SHA256 7b00b1329b4e57c45b5b7be936ac9c3b2f8f747e6a2b2d86642f8cd3deca5ab5
Score
5/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\003401d84fe2783f9f2658743d8635f9.exe"C:\Users\Admin\AppData\Local\Temp\003401d84fe2783f9f2658743d8635f9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\003401d84fe2783f9f2658743d8635f9.exe"C:\Users\Admin\AppData\Local\Temp\003401d84fe2783f9f2658743d8635f9.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 3123⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2060-114-0x0000000000A60000-0x0000000000A61000-memory.dmp
memory/2060-116-0x0000000005AC0000-0x0000000005AC1000-memory.dmp
memory/2060-117-0x0000000005660000-0x0000000005661000-memory.dmp
memory/2060-118-0x00000000053B0000-0x00000000053B1000-memory.dmp
memory/2060-119-0x0000000005700000-0x00000000057FA000-memory.dmp
memory/2060-120-0x0000000005AA0000-0x0000000005AA1000-memory.dmp
memory/2060-121-0x0000000009090000-0x0000000009091000-memory.dmp
memory/2060-122-0x0000000009670000-0x0000000009675000-memory.dmp
memory/3808-123-0x0000000000400000-0x000000000047A000-memory.dmp
memory/3808-125-0x0000000000400000-0x000000000047A000-memory.dmp