54aea79392cacfa0125aec072799e235bb3d18f6c45aeba807099fd0b6be873f | Triage

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-10-2022 09:03

Sharing

Report Analysis Logs

General

Target

COTIZAR_.exe
Size

19KB
MD5

496c17c3ffba9e26c620d7bf6f14ecbf
SHA1

c16449a9b28e207148cc5d6a4a1c28cafb8273ee
SHA256

54aea79392cacfa0125aec072799e235bb3d18f6c45aeba807099fd0b6be873f
SHA512

2840e98115db24f21e04e7e020317bf5daa7fbe0836f2752ff41fdfdd9d7c55d41c869874fa0d2fe5de4b734cc173498d80a9dab3b99a69455874811a093c55f
SSDEEP

384:iyPIfwSaB6m71+Tes8ZpHzGovUJAYkr5kYZFP:iygfwTcesiRPPrk+FP

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1720	1944	WerFault.exe	26

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1944	COTIZAR_.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 1720	1944	COTIZAR_.exe	27
PID 1944 wrote to memory of 1720	1944	COTIZAR_.exe	27
PID 1944 wrote to memory of 1720	1944	COTIZAR_.exe	27
PID 1944 wrote to memory of 1720	1944	COTIZAR_.exe	27

C:\Users\Admin\AppData\Local\Temp\COTIZAR_.exe
"C:\Users\Admin\AppData\Local\Temp\COTIZAR_.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 1128
  2⤵
  - Program crash
  PID:1720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1944-54-0x00000000000C0000-0x00000000000C8000-memory.dmp

Filesize
32KB

Download
memory/1944-55-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download