Analysis
- max time kernel
61s - max time network
77s - platform
windows10-2004_x64 - resource
win10v2004-20220721-en - resource tags
- submitted
21/07/2022, 12:17
General
- Target 문의.exe
- Size 1.0MB
- Sample220721-pf2daafch7
- SHA256 f92f663f8f3a0eb9aa71214253b157153bc4c9b386e4189c00017ec85e9d6913
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\문의.exe"C:\Users\Admin\AppData\Local\Temp\문의.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3332 -s 11722⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3332 -ip 33321⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3332-130-0x0000000000A90000-0x0000000000B9E000-memory.dmp
memory/3332-131-0x0000000005BC0000-0x0000000006164000-memory.dmp
memory/3332-132-0x0000000005530000-0x00000000055C2000-memory.dmp
memory/3332-133-0x00000000055F0000-0x00000000055FA000-memory.dmp
memory/3332-134-0x0000000008E50000-0x0000000008EEC000-memory.dmp