Overview

overview

3

Static

static

05096a801e...91.exe

windows7_x64

3

05096a801e...91.exe

windows10_x64

3

Analysis

  • max time kernel
    117s
  • max time network
    89s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    21-07-2021 22:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    05096a801e403309a7968d36a09b7091.exe

  • Size

    21KB

  • MD5

    05096a801e403309a7968d36a09b7091

  • SHA1

    c7016541d0addbd75b3e7bf20b8356d757ada471

  • SHA256

    25b93e036415a70c292d3c3befd7e7f8919f714860882aeac25f16422633f16a

  • SHA512

    f3d4621c8f27fae3e16b5dd2e8b0d616ced3ce51ec5b21b8a3efbfbdd83930be2105eb5d8fe7f7a7da51a929d0fbe7f0d5b6d69c6f94a9943a48f1f434f6ec36

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\05096a801e403309a7968d36a09b7091.exe
    "C:\Users\Admin\AppData\Local\Temp\05096a801e403309a7968d36a09b7091.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1028
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 1004
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      PID:2040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1028-60-0x0000000001080000-0x0000000001081000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1028-62-0x0000000004AF0000-0x0000000004AF1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2040-63-0x0000000000000000-mapping.dmp
    Download
  • memory/2040-64-0x00000000008E0000-0x00000000008E1000-memory.dmp
    Filesize

    4KB

    Download