Analysis
-
max time kernel
62s -
max time network
123s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
22-10-2021 05:29
General
-
Target
支払い命令.exe
-
Size
541KB
-
MD5
f5fabfdc406897f2026193d2c50f9e33
-
SHA1
57c68b743c7f80c2365ddfff0e0c2253b2cc0628
-
SHA256
b64a7759ecf0ee5e886d56faa7dc557f0a1b06f63c39cc2f96feb1e8dd150c94
-
SHA512
222e882cb32c25998888dfbb4f9c415ff69ce285fabb8ffdc1a3dc0f7ec7210b46cdf751b39c7e75bd3a7280f85f1997d25c528feaef0b7f48c355aa4d35724d
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\支払い命令.exe"C:\Users\Admin\AppData\Local\Temp\支払い命令.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 12082⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4188-115-0x00000000004C0000-0x00000000004C1000-memory.dmpFilesize
4KB
-
memory/4188-117-0x0000000005310000-0x0000000005311000-memory.dmpFilesize
4KB
-
memory/4188-118-0x0000000004E10000-0x0000000004E11000-memory.dmpFilesize
4KB
-
memory/4188-119-0x0000000004E10000-0x000000000530E000-memory.dmpFilesize
5.0MB
-
memory/4188-120-0x0000000004D80000-0x0000000004D81000-memory.dmpFilesize
4KB
-
memory/4188-121-0x0000000005B70000-0x0000000005B77000-memory.dmpFilesize
28KB
-
memory/4188-122-0x0000000008AA0000-0x0000000008AA1000-memory.dmpFilesize
4KB
-
memory/4188-123-0x0000000008B40000-0x0000000008B98000-memory.dmpFilesize
352KB