Analysis
- max time kernel
146s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
15/06/2022, 20:04
General
- Target 34e5ea61c2e68a2eadb85ce4d80402f7.exe
- Size 21KB
- Sample220615-ys84bsegf2
- SHA256 89fd50a006af9537d9181a8d2dd4872cd29639150ef2ed96a93ed1c3ad1967a4
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\34e5ea61c2e68a2eadb85ce4d80402f7.exe"C:\Users\Admin\AppData\Local\Temp\34e5ea61c2e68a2eadb85ce4d80402f7.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Start-Sleep -Seconds 10;Start-Sleep -Seconds 10;2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 15002⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1736 -ip 17361⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1736-130-0x00000000002A0000-0x00000000002AA000-memory.dmp
memory/2492-132-0x00000000048E0000-0x0000000004916000-memory.dmp
memory/2492-133-0x0000000005060000-0x0000000005688000-memory.dmp
memory/2492-134-0x0000000004FD0000-0x0000000004FF2000-memory.dmp
memory/2492-135-0x0000000005700000-0x0000000005766000-memory.dmp
memory/2492-136-0x0000000005770000-0x00000000057D6000-memory.dmp
memory/2492-137-0x0000000005E40000-0x0000000005E5E000-memory.dmp
memory/2492-138-0x0000000007520000-0x0000000007B9A000-memory.dmp
memory/2492-139-0x00000000063A0000-0x00000000063BA000-memory.dmp