Overview

overview

10

Static

static

NEW_DOC_02...B).exe

windows7_x64

3

NEW_DOC_02...B).exe

windows10_x64

10

Analysis

  • max time kernel
    121s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-en-20211104
  • submitted
    02-12-2021 03:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    NEW_DOC_02122021_009098.PDF (121KB).exe

  • Size

    696KB

  • MD5

    16121d662e114b1336a4ad6020cf79d4

  • SHA1

    6edec812f7ca2c4765db7d23e2c8ea3a8bf649e5

  • SHA256

    a9737b0f037cb0d159fe1ab785906e037b14d656c149176b4819098dc02cd64e

  • SHA512

    93cde2fd849410a9d75835f125f796410c18cf7ef28cd21865b68b5a85e2850eb99cf68bea576e3dc6f1b36d3a25abc3ddd140f9a60642538fe6c8b63308b0e2

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEW_DOC_02122021_009098.PDF (121KB).exe
    "C:\Users\Admin\AppData\Local\Temp\NEW_DOC_02122021_009098.PDF (121KB).exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1296
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1296 -s 668
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/816-61-0x0000000000000000-mapping.dmp
    Download
  • memory/816-62-0x00000000004A0000-0x00000000004A1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1296-55-0x0000000000920000-0x0000000000921000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1296-57-0x0000000075D61000-0x0000000075D63000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1296-58-0x0000000004E50000-0x0000000004E51000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1296-59-0x0000000000670000-0x0000000000678000-memory.dmp
    Filesize

    32KB

    Download
  • memory/1296-60-0x00000000055F0000-0x000000000568A000-memory.dmp
    Filesize

    616KB

    Download