Overview

overview

10

Static

static

a4dcba5e4a...60.exe

windows7_x64

10

a4dcba5e4a...60.exe

windows10-2004_x64

1

Analysis

  • max time kernel
    141s
  • max time network
    165s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    25-05-2022 00:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a4dcba5e4a6a379e614d12f3bd70189340c3212e5b51e91217418845b6689e60.exe

  • Size

    468KB

  • MD5

    77072f4aced3c82497dbd51becba0a95

  • SHA1

    fb475aa21d80c1234dc43c5b0c047664cdd7fdc9

  • SHA256

    a4dcba5e4a6a379e614d12f3bd70189340c3212e5b51e91217418845b6689e60

  • SHA512

    20192a9c39b801751377a6d6ee807bbfa86c4738ad534b1bc37f7c10cced926518b52de7550ba4e5e824c72a194570844fac5cc4ecdf4518d6ebf9cce00992a0

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a4dcba5e4a6a379e614d12f3bd70189340c3212e5b51e91217418845b6689e60.exe
    "C:\Users\Admin\AppData\Local\Temp\a4dcba5e4a6a379e614d12f3bd70189340c3212e5b51e91217418845b6689e60.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3980
    • C:\Windows\system32\wermgr.exe
      C:\Windows\system32\wermgr.exe
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3980-133-0x00000000023C0000-0x00000000023F3000-memory.dmp

    Filesize

    204KB

    Download

  • memory/3980-134-0x00000000023C0000-0x00000000023F3000-memory.dmp

    Filesize

    204KB

    Download

  • memory/4448-135-0x0000000000000000-mapping.dmp

    Download

  • memory/4448-136-0x000002DC40DF0000-0x000002DC40E14000-memory.dmp

    Filesize

    144KB

    Download