Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
20-10-2021 00:27
General
-
Target
202110207367475849758.PDF.exe
-
Size
28KB
-
MD5
efc321c36f4e1634c063378e4c3b3918
-
SHA1
97761a7e2ffa6fb8948184c2091099c681261a79
-
SHA256
17324605be6f982cfcc72159f95280a29ccd42e1c57f8701ecfb9ddd6a8a4b7f
-
SHA512
c2c9086b2d95efab45527cdddad2ebafd5a3c4196a897e0ca111f43c50778d9468d444fe3573e717a3e44eebbd84c5fb1b6d6842f27f505ab5d9192d23ec0c2b
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\202110207367475849758.PDF.exe"C:\Users\Admin\AppData\Local\Temp\202110207367475849758.PDF.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 11402⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1164-53-0x0000000000350000-0x0000000000351000-memory.dmpFilesize
4KB
-
memory/1164-55-0x0000000076201000-0x0000000076203000-memory.dmpFilesize
8KB
-
memory/1164-56-0x0000000004D10000-0x0000000004D11000-memory.dmpFilesize
4KB
-
memory/1200-57-0x0000000000000000-mapping.dmp
-
memory/1200-58-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB