996e0d318e87eec169553d7a73048312946a95d9f07cb6f7ac01227955ad619c | Triage

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
25-07-2022 02:59

Sharing

Report Analysis Logs

General

Target

PO3117_002422.exe
Size

11KB
MD5

a870810c6219011f00d22b6881c322b7
SHA1

3569ca5bd8eb29b3fdaa5fbf2209ea69d38428fc
SHA256

996e0d318e87eec169553d7a73048312946a95d9f07cb6f7ac01227955ad619c
SHA512

0a95e3cbb62f387fd078dc3c81cb944bde566baecb14642f580249cb4a054e2b5e024103150552636f8f2a030a00927ce425f8da2d9ce492bcbc466db09605f7

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1744 1948 WerFault.exe PO3117_002422.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

PO3117_002422.exe

description pid process

Token: SeDebugPrivilege 1948 PO3117_002422.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

PO3117_002422.exe

description	pid	process	target process
PID 1948 wrote to memory of 1744	1948	PO3117_002422.exe	WerFault.exe
PID 1948 wrote to memory of 1744	1948	PO3117_002422.exe	WerFault.exe
PID 1948 wrote to memory of 1744	1948	PO3117_002422.exe	WerFault.exe
PID 1948 wrote to memory of 1744	1948	PO3117_002422.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\PO3117_002422.exe
"C:\Users\Admin\AppData\Local\Temp\PO3117_002422.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 1128
2⤵
- Program crash
PID:1744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1744-56-0x0000000000000000-mapping.dmp

Download
memory/1948-54-0x0000000001160000-0x000000000116A000-memory.dmp

Filesize
40KB

Download
memory/1948-55-0x0000000075301000-0x0000000075303000-memory.dmp

Filesize
8KB

Download