Analysis
-
max time kernel
44s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
12-05-2022 11:50
General
-
Target
463839def6d60788a92ecd43af8d3f4a421d658059c6d8226bc12e02f76101e1.exe
-
Size
141KB
-
MD5
7c22531ea58fe480003d63a5cf8a1430
-
SHA1
76f979c71a75e20d6f8f316126e3badb17b33b20
-
SHA256
463839def6d60788a92ecd43af8d3f4a421d658059c6d8226bc12e02f76101e1
-
SHA512
6d2355984fd2d3dac55ade9e7c8436fc71a5b293295b21b01d83433d091eb0dcf08d06015fa85912cb7e8bce8bf7ee1c328ac71205f7d638f4b43d9fd19f39b2
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\463839def6d60788a92ecd43af8d3f4a421d658059c6d8226bc12e02f76101e1.exe"C:\Users\Admin\AppData\Local\Temp\463839def6d60788a92ecd43af8d3f4a421d658059c6d8226bc12e02f76101e1.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1564 -s 10202⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1564-54-0x0000000001150000-0x000000000117C000-memory.dmpFilesize
176KB
-
memory/1564-55-0x0000000000520000-0x0000000000526000-memory.dmpFilesize
24KB
-
memory/1564-56-0x0000000000570000-0x0000000000588000-memory.dmpFilesize
96KB
-
memory/1564-57-0x0000000000580000-0x0000000000586000-memory.dmpFilesize
24KB
-
memory/1564-58-0x0000000075CD1000-0x0000000075CD3000-memory.dmpFilesize
8KB
-
memory/1692-59-0x0000000000000000-mapping.dmp