Analysis
-
max time kernel
152s -
max time network
121s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
07-12-2021 10:48
General
-
Target
6430cb23ebe6fd38dd12dd0a579e9e3b.exe
-
Size
372KB
-
MD5
6430cb23ebe6fd38dd12dd0a579e9e3b
-
SHA1
0564f13201c8d65ab64842742c761b5bc912b832
-
SHA256
5405e311e63cb69c69bc2eba909547fca4d91a60e998bcc825c1031cd148f816
-
SHA512
3e3e6b1b3096961a1b5081204cff23dcd1968fbb7cd5a9cd8dd0859cb1574cfe2581678f62edf4f54f95b481a51513c06255d7adb5c60f263df588fc68b41eac
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6430cb23ebe6fd38dd12dd0a579e9e3b.exe"C:\Users\Admin\AppData\Local\Temp\6430cb23ebe6fd38dd12dd0a579e9e3b.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 7042⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/524-55-0x0000000000F60000-0x0000000000F61000-memory.dmpFilesize
4KB
-
memory/524-57-0x0000000074E51000-0x0000000074E53000-memory.dmpFilesize
8KB
-
memory/524-58-0x00000000046B0000-0x00000000046B1000-memory.dmpFilesize
4KB
-
memory/524-59-0x00000000003F0000-0x00000000003F8000-memory.dmpFilesize
32KB
-
memory/524-60-0x0000000004FE0000-0x0000000005029000-memory.dmpFilesize
292KB
-
memory/1696-61-0x0000000000000000-mapping.dmp
-
memory/1696-62-0x0000000000310000-0x0000000000311000-memory.dmpFilesize
4KB