Analysis
-
max time kernel
141s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
25-05-2022 00:26
Static task
static1
Behavioral task
behavioral1
Sample
a4dcba5e4a6a379e614d12f3bd70189340c3212e5b51e91217418845b6689e60.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a4dcba5e4a6a379e614d12f3bd70189340c3212e5b51e91217418845b6689e60.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
a4dcba5e4a6a379e614d12f3bd70189340c3212e5b51e91217418845b6689e60.exe
-
Size
468KB
-
MD5
77072f4aced3c82497dbd51becba0a95
-
SHA1
fb475aa21d80c1234dc43c5b0c047664cdd7fdc9
-
SHA256
a4dcba5e4a6a379e614d12f3bd70189340c3212e5b51e91217418845b6689e60
-
SHA512
20192a9c39b801751377a6d6ee807bbfa86c4738ad534b1bc37f7c10cced926518b52de7550ba4e5e824c72a194570844fac5cc4ecdf4518d6ebf9cce00992a0
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
wermgr.exedescription pid process Token: SeDebugPrivilege 4448 wermgr.exe Token: SeDebugPrivilege 4448 wermgr.exe Token: SeDebugPrivilege 4448 wermgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
a4dcba5e4a6a379e614d12f3bd70189340c3212e5b51e91217418845b6689e60.exepid process 3980 a4dcba5e4a6a379e614d12f3bd70189340c3212e5b51e91217418845b6689e60.exe 3980 a4dcba5e4a6a379e614d12f3bd70189340c3212e5b51e91217418845b6689e60.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
a4dcba5e4a6a379e614d12f3bd70189340c3212e5b51e91217418845b6689e60.exedescription pid process target process PID 3980 wrote to memory of 4448 3980 a4dcba5e4a6a379e614d12f3bd70189340c3212e5b51e91217418845b6689e60.exe wermgr.exe PID 3980 wrote to memory of 4448 3980 a4dcba5e4a6a379e614d12f3bd70189340c3212e5b51e91217418845b6689e60.exe wermgr.exe PID 3980 wrote to memory of 4448 3980 a4dcba5e4a6a379e614d12f3bd70189340c3212e5b51e91217418845b6689e60.exe wermgr.exe PID 3980 wrote to memory of 4448 3980 a4dcba5e4a6a379e614d12f3bd70189340c3212e5b51e91217418845b6689e60.exe wermgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4dcba5e4a6a379e614d12f3bd70189340c3212e5b51e91217418845b6689e60.exe"C:\Users\Admin\AppData\Local\Temp\a4dcba5e4a6a379e614d12f3bd70189340c3212e5b51e91217418845b6689e60.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3980-133-0x00000000023C0000-0x00000000023F3000-memory.dmpFilesize
204KB
-
memory/3980-134-0x00000000023C0000-0x00000000023F3000-memory.dmpFilesize
204KB
-
memory/4448-135-0x0000000000000000-mapping.dmp
-
memory/4448-136-0x000002DC40DF0000-0x000002DC40E14000-memory.dmpFilesize
144KB