33fd2f2b2053150f21129807c381d38874c7622d207a8d036782db82cc61455b | Triage

Resubmissions

09-12-2021 17:57

211209-wj1dqaeedq 10

06-12-2021 09:45

211206-lrasxsgeh3 3

22-11-2021 13:35

211122-qvrytsfehq 3

Analysis

max time kernel
23s
max time network
0s
platform
windows7_x64
resource
win7-en-20211104
submitted
06-12-2021 09:45

Sharing

Report Analysis Logs

General

Target

2.exe
Size

177KB
MD5

20478d2d2b86e6c8c9da84af39fd652b
SHA1

f9c926efee370218d0d82dd75e703f46355e6018
SHA256

33fd2f2b2053150f21129807c381d38874c7622d207a8d036782db82cc61455b
SHA512

a348e4d5245b6aff3242f02f66415874a6380fa26740ed18ff2e995a87a386acc2e93182066abc3d6e7dc253909ed79099db70209ca38f779adb7fe67c78b613

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
608	1296	WerFault.exe	26

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
608	WerFault.exe
608	WerFault.exe
608	WerFault.exe
608	WerFault.exe
608	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	608	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 608	1296	2.exe	27
PID 1296 wrote to memory of 608	1296	2.exe	27
PID 1296 wrote to memory of 608	1296	2.exe	27

C:\Users\Admin\AppData\Local\Temp\2.exe
"C:\Users\Admin\AppData\Local\Temp\2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1296 -s 116
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/608-56-0x000007FEFBFF1000-0x000007FEFBFF3000-memory.dmp

Filesize
8KB

Download
memory/608-57-0x0000000000490000-0x0000000000491000-memory.dmp

Filesize
4KB

Download