Analysis
- max time kernel
77s - max time network
149s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
30/12/2021, 03:17
General
- Target RFQ Product Inquiry Catalogue.exe
- Size 88KB
- Sample211230-ds3akafea3
- SHA256 875ddce13022bafdf9e27f3eab2af78147c589037bf9c86192091e3843cedb16
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ Product Inquiry Catalogue.exe"C:\Users\Admin\AppData\Local\Temp\RFQ Product Inquiry Catalogue.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 20002⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3764-115-0x0000000000DE0000-0x0000000000DFC000-memory.dmp
memory/3764-116-0x0000000000DE0000-0x0000000000DFC000-memory.dmp
memory/3764-117-0x0000000005BD0000-0x00000000060CE000-memory.dmp
memory/3764-118-0x0000000005620000-0x00000000056B2000-memory.dmp
memory/3764-119-0x00000000056D0000-0x0000000005BCE000-memory.dmp