Overview

overview

10

Static

static

10

2c8ff4d56b...44.exe

windows7_x64

3

2c8ff4d56b...44.exe

windows10_x64

3

Analysis

  • max time kernel
    117s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    30-01-2022 07:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2c8ff4d56b32520a12186a59b34aff782617ed6f523f0524ac4b2cc38ec73044.exe

  • Size

    381KB

  • MD5

    86f436d4fd15f9ff2cd1ae317799d596

  • SHA1

    23e01fdd3ea53f08e9d3c493afd6b4da669c6bac

  • SHA256

    2c8ff4d56b32520a12186a59b34aff782617ed6f523f0524ac4b2cc38ec73044

  • SHA512

    a1f959a95c426b2949af582e6d296eda7cbb6ee790ac2f7de09f8fc843077d08adc5a2fa2d7279e206e2cc9643e93ec7d32ea80dc1628f02586d5ddae31c2d21

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2c8ff4d56b32520a12186a59b34aff782617ed6f523f0524ac4b2cc38ec73044.exe
    "C:\Users\Admin\AppData\Local\Temp\2c8ff4d56b32520a12186a59b34aff782617ed6f523f0524ac4b2cc38ec73044.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1844
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 36
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      PID:1084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1084-54-0x0000000075341000-0x0000000075343000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1084-55-0x00000000008B0000-0x00000000008B1000-memory.dmp
    Filesize

    4KB

    Download