Analysis
- max time kernel
137s - max time network
138s - platform
windows7_x64 - resource
win7-en - submitted
06/09/2021, 13:59
General
- Target 821-2109060049杜氏诚发_pdf.exe
- Size 842KB
- Sample210906-rad2xaedbk
- SHA256 f84cc4838c3d9bacdaa67c1b7e658b8b59dd8e9db2ad1be06f5218defd2c1070
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\821-2109060049杜氏诚发_pdf.exe"C:\Users\Admin\AppData\Local\Temp\821-2109060049杜氏诚发_pdf.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 7202⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/988-60-0x00000000006A0000-0x00000000006A1000-memory.dmp
memory/1316-53-0x0000000000890000-0x0000000000891000-memory.dmp
memory/1316-55-0x0000000004E60000-0x0000000004E61000-memory.dmp
memory/1316-56-0x00000000004F0000-0x0000000000506000-memory.dmp
memory/1316-57-0x0000000004F00000-0x0000000004F5F000-memory.dmp
memory/1316-58-0x0000000001F00000-0x0000000001F38000-memory.dmp