Analysis
- max time kernel
57s - max time network
151s - platform
windows10_x64 - resource
win10v20210408 - submitted
17/08/2021, 07:37
General
- Target 7cf69ae411c970a920a1b31ba4b97c2c.exe
- Size 1.2MB
- Sample210817-161pajcc3n
- SHA256 5e351f6e3fab38ce9b8d0bb05b2abee98c1e00d8a7632c8ca36fb4c6992dbd0c
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7cf69ae411c970a920a1b31ba4b97c2c.exe"C:\Users\Admin\AppData\Local\Temp\7cf69ae411c970a920a1b31ba4b97c2c.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 12162⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/396-114-0x00000000002F0000-0x00000000002F1000-memory.dmp
memory/396-116-0x0000000004BE0000-0x0000000004C59000-memory.dmp
memory/396-117-0x00000000071D0000-0x00000000071D1000-memory.dmp
memory/396-118-0x0000000007770000-0x0000000007771000-memory.dmp
memory/396-119-0x0000000007310000-0x0000000007311000-memory.dmp
memory/396-120-0x00000000071C0000-0x00000000071C1000-memory.dmp
memory/396-121-0x0000000007470000-0x0000000007471000-memory.dmp
memory/396-122-0x0000000004C70000-0x0000000004C71000-memory.dmp
memory/396-123-0x0000000002510000-0x0000000002521000-memory.dmp