Analysis
-
max time kernel
13s -
max time network
115s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
02/08/2021, 19:58
Static task
static1
Behavioral task
behavioral1
Sample
service.bin.exe
Resource
win7v20210408
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
service.bin.exe
Resource
win10v20210410
0 signatures
0 seconds
General
-
Target
service.bin.exe
-
Size
680KB
-
MD5
d3e88703aaa4fe2bfdb0f663744724cc
-
SHA1
a1cc305fefde48e889325437a33a6572e3899654
-
SHA256
992ddc778bc3af49b9b7c424071cfe0db67dbcee83994debfee421ef4190d473
-
SHA512
bdfa11eebd000973b83be71a813ae4ecd6aae00cd1f7e6a738f7fcdb07784fe1386c50185bfda697d9c96f1cdb7dd0f45f02e55a319d6ce302179c04980fd8f7
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3944 set thread context of 612 3944 service.bin.exe 72 -
Program crash 1 IoCs
pid pid_target Process procid_target 1360 612 WerFault.exe 72 -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1360 WerFault.exe 1360 WerFault.exe 1360 WerFault.exe 1360 WerFault.exe 1360 WerFault.exe 1360 WerFault.exe 1360 WerFault.exe 1360 WerFault.exe 1360 WerFault.exe 1360 WerFault.exe 1360 WerFault.exe 1360 WerFault.exe 1360 WerFault.exe 1360 WerFault.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 3944 service.bin.exe 3944 service.bin.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 1360 WerFault.exe Token: SeBackupPrivilege 1360 WerFault.exe Token: SeDebugPrivilege 1360 WerFault.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3944 wrote to memory of 612 3944 service.bin.exe 72 PID 3944 wrote to memory of 612 3944 service.bin.exe 72 PID 3944 wrote to memory of 612 3944 service.bin.exe 72 PID 3944 wrote to memory of 612 3944 service.bin.exe 72
Processes
-
C:\Users\Admin\AppData\Local\Temp\service.bin.exe"C:\Users\Admin\AppData\Local\Temp\service.bin.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\service.bin.exe"C:\Users\Admin\AppData\Local\Temp\service.bin.exe"2⤵PID:612
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 612 -s 2843⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1360
-
-