Overview

overview

3

Static

static

PO_76543567.exe

windows7_x64

3

PO_76543567.exe

windows10_x64

3

Analysis

  • max time kernel
    137s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-en
  • submitted
    15-09-2021 07:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    PO_76543567.exe

  • Size

    563KB

  • MD5

    c0e99ed45e980f0cc6fc64f2a8595b67

  • SHA1

    334dc4eef4ad6fad2174537e50845612c457272f

  • SHA256

    cc6d6f5069421669e286fa4f30b4bc0e5f2e049a4b79c298c54b35a06040f33b

  • SHA512

    654dfd23b590e87ae17375c7661def367155789c4015d4ace4f12b2a5d3c636ec2efcf914a6c18daf1e222cedcaf84145d525d083c4a266384b3759e9b979676

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PO_76543567.exe
    "C:\Users\Admin\AppData\Local\Temp\PO_76543567.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1032
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 756
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      PID:2004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1032-52-0x0000000000910000-0x0000000000911000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1032-54-0x0000000004240000-0x0000000004241000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2004-55-0x0000000000000000-mapping.dmp
    Download
  • memory/2004-56-0x0000000000340000-0x0000000000341000-memory.dmp
    Filesize

    4KB

    Download