Analysis
-
max time kernel
145s -
max time network
172s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
31-01-2022 03:58
General
-
Target
d69c972d578a3d4b15158ac14600f0e996113e510a4bc9815193c9e74740e612.exe
-
Size
116KB
-
MD5
1dc550eaf37331a8febe5d9f4176269e
-
SHA1
d77c9d5d3e916bbf97f33aeca8eadad8b517e68c
-
SHA256
d69c972d578a3d4b15158ac14600f0e996113e510a4bc9815193c9e74740e612
-
SHA512
b35b55c550ec583bf71554872e1410aac9ad1ef7711491f168069c229f56e19fb00712a2a7b1e4552ecb7905ca5ab12482ab2e071079de004cd5cb89c7ad4d85
Score
10/10
Malware Config
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d69c972d578a3d4b15158ac14600f0e996113e510a4bc9815193c9e74740e612.exe"C:\Users\Admin\AppData\Local\Temp\d69c972d578a3d4b15158ac14600f0e996113e510a4bc9815193c9e74740e612.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 5922⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3828-116-0x0000000002140000-0x0000000002141000-memory.dmpFilesize
4KB
-
memory/3828-115-0x0000000000570000-0x0000000000579000-memory.dmpFilesize
36KB
-
memory/3828-118-0x0000000002160000-0x0000000002161000-memory.dmpFilesize
4KB
-
memory/3828-117-0x0000000002150000-0x0000000002151000-memory.dmpFilesize
4KB
-
memory/3828-119-0x00000000021C0000-0x00000000021C6000-memory.dmpFilesize
24KB