81bc33ce9bf2c1eaec168f5a5a4c2da715a2fcbc8972daa23834e22e3d27c547 | Triage

Analysis

max time kernel
42s
max time network
44s
platform
windows7_x64
resource
win7-20220414-en
submitted
21/06/2022, 10:12

Sharing

Report Analysis Logs

General

Target

Kzckpxc.exe
Size

35KB
MD5

46c7424bbc974b8071f30e2c6494612b
SHA1

7e957166a5a73c6e7ddf9af391fd1837f4339a99
SHA256

81bc33ce9bf2c1eaec168f5a5a4c2da715a2fcbc8972daa23834e22e3d27c547
SHA512

b8463d95dd900c9a543cf7d9f9c34d6d557b84688c84c3b68f026ffd3ba5fe909b785a7de69d6c75ade8327e059840d7fdaa27634df357e8aad591fbc7a40544

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1216	1880	WerFault.exe	26

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1880	Kzckpxc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 1216	1880	Kzckpxc.exe	27
PID 1880 wrote to memory of 1216	1880	Kzckpxc.exe	27
PID 1880 wrote to memory of 1216	1880	Kzckpxc.exe	27
PID 1880 wrote to memory of 1216	1880	Kzckpxc.exe	27

C:\Users\Admin\AppData\Local\Temp\Kzckpxc.exe
"C:\Users\Admin\AppData\Local\Temp\Kzckpxc.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 1048
  2⤵
  - Program crash
  PID:1216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1880-54-0x00000000001C0000-0x00000000001D0000-memory.dmp

Filesize
64KB

Download
memory/1880-55-0x00000000755A1000-0x00000000755A3000-memory.dmp

Filesize
8KB

Download