Analysis
-
max time kernel
125s -
max time network
151s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
19-10-2021 14:27
General
-
Target
d2eaaa542a2968b2a9ebe288166779e8.exe
-
Size
63KB
-
MD5
d2eaaa542a2968b2a9ebe288166779e8
-
SHA1
37bcd26dcd35f9dd16bd8aff7cad425f3898309c
-
SHA256
f605ba8fe94eb367829b61cd05eb5b07f4702b55f2a0faf51589cb46dd6f89a9
-
SHA512
059a1aed6e654fb4465e11f7a0687ac4e6ec0bc17f4ca2726f1bf4f069c1c757b3577d0dd3e5f5b31cfd9e7c0750ffd2880da31053f5ad8f258227029df3e89a
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d2eaaa542a2968b2a9ebe288166779e8.exe"C:\Users\Admin\AppData\Local\Temp\d2eaaa542a2968b2a9ebe288166779e8.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 16362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1448-57-0x0000000000000000-mapping.dmp
-
memory/1448-58-0x0000000001D40000-0x0000000001D56000-memory.dmpFilesize
88KB
-
memory/1696-53-0x0000000000320000-0x0000000000321000-memory.dmpFilesize
4KB
-
memory/1696-55-0x00000000757B1000-0x00000000757B3000-memory.dmpFilesize
8KB
-
memory/1696-56-0x00000000048A0000-0x00000000048A1000-memory.dmpFilesize
4KB