9831694a7c5a2cc35a701744e35e7b268ac85074eb42f720e2cd32c3750c4c28 | Triage

Analysis

max time kernel
75s
max time network
86s
platform
windows7_x64
resource
win7-20220414-en
submitted
14-05-2022 13:50

Sharing

Report Analysis Logs

General

Target

9831694a7c5a2cc35a701744e35e7b268ac85074eb42f720e2cd32c3750c4c28.exe
Size

18KB
MD5

5f2319a18190cc7ef5a2de3e3201d2a5
SHA1

4dc571ca05abf85ef3a625641fb5deac57b70537
SHA256

9831694a7c5a2cc35a701744e35e7b268ac85074eb42f720e2cd32c3750c4c28
SHA512

79a3547ccc1d467d20f429528241e1381111ceeae4a050bd92443a0a225f63112506262e92a3067b00b145abebf54e21814c3fd7e929523642b2f328c52233e3

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2036 1484 WerFault.exe 9831694a7c5a2cc35a701744e35e7b268ac85074eb42f720e2cd32c3750c4c28.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

9831694a7c5a2cc35a701744e35e7b268ac85074eb42f720e2cd32c3750c4c28.exe

description pid process

Token: SeDebugPrivilege 1484 9831694a7c5a2cc35a701744e35e7b268ac85074eb42f720e2cd32c3750c4c28.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

9831694a7c5a2cc35a701744e35e7b268ac85074eb42f720e2cd32c3750c4c28.exe

description	pid	process	target process
PID 1484 wrote to memory of 2036	1484	9831694a7c5a2cc35a701744e35e7b268ac85074eb42f720e2cd32c3750c4c28.exe	WerFault.exe
PID 1484 wrote to memory of 2036	1484	9831694a7c5a2cc35a701744e35e7b268ac85074eb42f720e2cd32c3750c4c28.exe	WerFault.exe
PID 1484 wrote to memory of 2036	1484	9831694a7c5a2cc35a701744e35e7b268ac85074eb42f720e2cd32c3750c4c28.exe	WerFault.exe
PID 1484 wrote to memory of 2036	1484	9831694a7c5a2cc35a701744e35e7b268ac85074eb42f720e2cd32c3750c4c28.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\9831694a7c5a2cc35a701744e35e7b268ac85074eb42f720e2cd32c3750c4c28.exe
"C:\Users\Admin\AppData\Local\Temp\9831694a7c5a2cc35a701744e35e7b268ac85074eb42f720e2cd32c3750c4c28.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 1052
2⤵
- Program crash
PID:2036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1484-54-0x0000000000D00000-0x0000000000D0A000-memory.dmp

Filesize
40KB

Download
memory/1484-55-0x0000000076431000-0x0000000076433000-memory.dmp

Filesize
8KB

Download
memory/2036-56-0x0000000000000000-mapping.dmp

Download