Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
19-10-2021 13:22
Static task
static1
Behavioral task
behavioral1
Sample
ConsoleApp19.exe.bin.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ConsoleApp19.exe.bin.exe
Resource
win10-en-20211014
windows10_x64
0 signatures
0 seconds
General
-
Target
ConsoleApp19.exe.bin.exe
-
Size
28KB
-
MD5
4ca7ad65e21778c4ec8fab5129260d32
-
SHA1
461ae78946a55078590300798f08bc00e0e10d9d
-
SHA256
073a9a5eaf10598b2ebf99094fc29e04778ee7272319687d04c53f3d903de94c
-
SHA512
31b22762c0fb2d3d6c39bb5bd94c322a7d13cd6c5fd297e79955cd0095cbd4aaf7f4ab208ac304bf3069ce218a733dae6ac85d65cf15995bcbe649ad705820e8
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1384 1768 WerFault.exe ConsoleApp19.exe.bin.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
WerFault.exepid process 1384 WerFault.exe 1384 WerFault.exe 1384 WerFault.exe 1384 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ConsoleApp19.exe.bin.exeWerFault.exedescription pid process Token: SeDebugPrivilege 1768 ConsoleApp19.exe.bin.exe Token: SeDebugPrivilege 1384 WerFault.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
ConsoleApp19.exe.bin.exedescription pid process target process PID 1768 wrote to memory of 1384 1768 ConsoleApp19.exe.bin.exe WerFault.exe PID 1768 wrote to memory of 1384 1768 ConsoleApp19.exe.bin.exe WerFault.exe PID 1768 wrote to memory of 1384 1768 ConsoleApp19.exe.bin.exe WerFault.exe PID 1768 wrote to memory of 1384 1768 ConsoleApp19.exe.bin.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ConsoleApp19.exe.bin.exe"C:\Users\Admin\AppData\Local\Temp\ConsoleApp19.exe.bin.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 16242⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1384-57-0x0000000000000000-mapping.dmp
-
memory/1384-58-0x00000000006E0000-0x00000000006E1000-memory.dmpFilesize
4KB
-
memory/1768-53-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/1768-55-0x0000000075821000-0x0000000075823000-memory.dmpFilesize
8KB
-
memory/1768-56-0x00000000005A0000-0x00000000005A1000-memory.dmpFilesize
4KB