Analysis
- max time kernel
110s - max time network
121s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
01/11/2021, 09:28
General
- Target cotización.exe
- Size 379KB
- Sample211101-lfb7lsebfl
- SHA256 d8ed1732f84e3e0a0b6d079afee1c5da08a6cf2fd257fca87ff5172f98a696df
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cotización.exe"C:\Users\Admin\AppData\Local\Temp\cotización.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 11042⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3740-115-0x00000000004D0000-0x00000000004D1000-memory.dmp
memory/3740-117-0x0000000005430000-0x0000000005431000-memory.dmp
memory/3740-118-0x0000000004F30000-0x0000000004F31000-memory.dmp
memory/3740-119-0x0000000004F30000-0x000000000542E000-memory.dmp
memory/3740-120-0x0000000005020000-0x0000000005021000-memory.dmp