Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
03-12-2021 06:06
General
-
Target
Moresco - Inquiry MEI-120321,pdf.exe
-
Size
582KB
-
MD5
2ab46d1525daffd612d37d8ad4e917cf
-
SHA1
3450df35398dece6ad6eec2dc0a1cee490ef985d
-
SHA256
a666487c031511c40d0113b6cc8663f4f73059e5416a2c51e81f9c21b88d1daf
-
SHA512
e99f9a65b2e06eed345c8de87cda801368b177c535c492d2b8541d1a434262b9ac8a71b922214fbfb89352241b7d0b17523c2bb3f198eb64689990965e7c544e
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Moresco - Inquiry MEI-120321,pdf.exe"C:\Users\Admin\AppData\Local\Temp\Moresco - Inquiry MEI-120321,pdf.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 6682⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/824-61-0x0000000000000000-mapping.dmp
-
memory/824-62-0x0000000001DF0000-0x0000000001DF1000-memory.dmpFilesize
4KB
-
memory/1820-55-0x00000000002F0000-0x00000000002F1000-memory.dmpFilesize
4KB
-
memory/1820-57-0x0000000074A41000-0x0000000074A43000-memory.dmpFilesize
8KB
-
memory/1820-58-0x0000000000A80000-0x0000000000A81000-memory.dmpFilesize
4KB
-
memory/1820-59-0x00000000003D0000-0x00000000003D8000-memory.dmpFilesize
32KB
-
memory/1820-60-0x0000000004D20000-0x0000000004D89000-memory.dmpFilesize
420KB