ffbfee81490d1ff3b7a33aeaac56ef01dcb0b533c13b0d7bb43be3c5e0155212 | Triage

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-10-2022 09:01

Sharing

Report Analysis Logs

General

Target

COTIZAR_.exe
Size

19KB
MD5

496c17c3ffba9e26c620d7bf6f14ecbf
SHA1

c16449a9b28e207148cc5d6a4a1c28cafb8273ee
SHA256

54aea79392cacfa0125aec072799e235bb3d18f6c45aeba807099fd0b6be873f
SHA512

2840e98115db24f21e04e7e020317bf5daa7fbe0836f2752ff41fdfdd9d7c55d41c869874fa0d2fe5de4b734cc173498d80a9dab3b99a69455874811a093c55f
SSDEEP

384:iyPIfwSaB6m71+Tes8ZpHzGovUJAYkr5kYZFP:iygfwTcesiRPPrk+FP

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1220	1960	WerFault.exe	23

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1960	COTIZAR_.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 1220	1960	COTIZAR_.exe	28
PID 1960 wrote to memory of 1220	1960	COTIZAR_.exe	28
PID 1960 wrote to memory of 1220	1960	COTIZAR_.exe	28
PID 1960 wrote to memory of 1220	1960	COTIZAR_.exe	28

C:\Users\Admin\AppData\Local\Temp\COTIZAR_.exe
"C:\Users\Admin\AppData\Local\Temp\COTIZAR_.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 1128
  2⤵
  - Program crash
  PID:1220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1960-54-0x0000000000A30000-0x0000000000A38000-memory.dmp

Filesize
32KB

Download
memory/1960-55-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

Filesize
8KB

Download