Analysis
-
max time kernel
129s -
max time network
126s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
16-10-2021 14:31
General
-
Target
0acf7a0f0cea79d46c162eb227adb701.exe
-
Size
19KB
-
MD5
0acf7a0f0cea79d46c162eb227adb701
-
SHA1
c92b5dac7598717b3ee19fb50a2a96b48d69dfeb
-
SHA256
9454554ff02715a0e17bde7743b9fa2eb0795058d02c178b148d2c090396dfba
-
SHA512
496cacd20d75f584619d98fe223267c117a2e5dfed7133141ec23ca550669536af9011b773ca894aa81a40a29ae057a0991b6d3ffb628a3386b4e17a0d742714
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0acf7a0f0cea79d46c162eb227adb701.exe"C:\Users\Admin\AppData\Local\Temp\0acf7a0f0cea79d46c162eb227adb701.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 15882⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1044-53-0x0000000000BC0000-0x0000000000BC1000-memory.dmpFilesize
4KB
-
memory/1044-55-0x0000000075871000-0x0000000075873000-memory.dmpFilesize
8KB
-
memory/1044-56-0x0000000004CA0000-0x0000000004CA1000-memory.dmpFilesize
4KB
-
memory/1132-57-0x0000000000000000-mapping.dmp
-
memory/1132-58-0x00000000004E0000-0x00000000004E1000-memory.dmpFilesize
4KB