6d891a2985e39d8b0cb720b24f92deb90370f5e25cf4158b5d224802475a8e66 | Triage

Analysis

max time kernel
39s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-09-2022 21:32

Sharing

Report Analysis Logs

General

Target

image001.exe
Size

138KB
MD5

eb89816844f308ccfae4bbe2a72d527d
SHA1

6f04b00bdb256b616ac1edadf637378fccb36670
SHA256

6d891a2985e39d8b0cb720b24f92deb90370f5e25cf4158b5d224802475a8e66
SHA512

48cac0381d7ce3db389895c49a3c3ffff0f3edf1217d4515d081d5c768bc9d5b75018953f348f175585b797d36e7da6a9f300c2d04fa6678b8bebf0d0ec6665c
SSDEEP

3072:m1TBs5bEg6AAAITTE4R2GZzuj7Fnkob8x4zJLr:UBs5bEg6/T44R2GZzuj7Fkob8x

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1260 900 WerFault.exe image001.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

image001.exe

description pid process

Token: SeDebugPrivilege 900 image001.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

image001.exe

description	pid	process	target process
PID 900 wrote to memory of 1260	900	image001.exe	WerFault.exe
PID 900 wrote to memory of 1260	900	image001.exe	WerFault.exe
PID 900 wrote to memory of 1260	900	image001.exe	WerFault.exe
PID 900 wrote to memory of 1260	900	image001.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\image001.exe
"C:\Users\Admin\AppData\Local\Temp\image001.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 1008
2⤵
- Program crash
PID:1260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/900-54-0x0000000000BC0000-0x0000000000BE8000-memory.dmp

Filesize
160KB

Download
memory/900-55-0x0000000075C61000-0x0000000075C63000-memory.dmp

Filesize
8KB

Download
memory/1260-56-0x0000000000000000-mapping.dmp

Download