da81995799de9fc062c9add3ada7e0127ee8bf7d7c8c7cc04fd4915b743f6210 | Triage

Resubmissions

13/09/2022, 07:28

220913-jarc8sfac7 3

08/07/2022, 12:13

220708-pd344acdbk 10

Analysis

max time kernel
47s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
13/09/2022, 07:28

Sharing

Report Analysis Logs

General

Target

kyrrtuyd.exe
Size

2.7MB
MD5

ea1b1668c8c83691ab1d0fcfda35f113
SHA1

a936e2ba04c4a307c32fec7c5bd146459c60b722
SHA256

da81995799de9fc062c9add3ada7e0127ee8bf7d7c8c7cc04fd4915b743f6210
SHA512

9e176eb86cdff5a06edba1aa6689047688ac1e25a61a5d79cfb2b78276e45996439a85938f0cd978cfe75941e14236f298807eb950cabdf227829e4d23948527
SSDEEP

49152:8z1aFEvpqvsgPQqfa2/bYwIjq/gBWVEDvrsx0BrIBlY2vIdJNyA+TDer:m1aFEvdg5/cwUAgBFIxtPgVyAMSr

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1948	2020	WerFault.exe	25

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2020	kyrrtuyd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1948	2020	kyrrtuyd.exe	27
PID 2020 wrote to memory of 1948	2020	kyrrtuyd.exe	27
PID 2020 wrote to memory of 1948	2020	kyrrtuyd.exe	27

C:\Users\Admin\AppData\Local\Temp\kyrrtuyd.exe
"C:\Users\Admin\AppData\Local\Temp\kyrrtuyd.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2020 -s 744
  2⤵
  - Program crash
  PID:1948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2020-54-0x00000000001C0000-0x0000000000486000-memory.dmp

Filesize
2.8MB

Download