664c3a7e8d4c5316a116a2c00595fb66e338012898b09d44218ae8374477fab8 | Triage

Analysis

max time kernel
146s
max time network
130s
platform
windows7_x64
resource
win7-en-20210920
submitted
21-09-2021 09:20

Sharing

Report Analysis Logs

General

Target

adobe1_04360000_unpacked.exe
Size

660KB
MD5

923a849bd0e4dcea6ee5c4eeabecffec
SHA1

6cbdee32471fe4909067093352e7412358c7bd80
SHA256

664c3a7e8d4c5316a116a2c00595fb66e338012898b09d44218ae8374477fab8
SHA512

61caf1852fa61378a69df1b1d7bd3684f39d3d2c28f12700f2b3481dca312cbc4c3f80787e57184b47b8e10f77ff4cac081c7b86d2e4853705c8ec4c05cd1527

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1088	1268	WerFault.exe	26

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1088	WerFault.exe
1088	WerFault.exe
1088	WerFault.exe
1088	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1088	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1088	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 1088	1268	adobe1_04360000_unpacked.exe	27
PID 1268 wrote to memory of 1088	1268	adobe1_04360000_unpacked.exe	27
PID 1268 wrote to memory of 1088	1268	adobe1_04360000_unpacked.exe	27
PID 1268 wrote to memory of 1088	1268	adobe1_04360000_unpacked.exe	27

C:\Users\Admin\AppData\Local\Temp\adobe1_04360000_unpacked.exe
"C:\Users\Admin\AppData\Local\Temp\adobe1_04360000_unpacked.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 188
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1088

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1088-56-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/1268-53-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download
memory/1268-54-0x0000000013140000-0x000000001338A000-memory.dmp

Filesize
2.3MB

Download