42ff33d8a2c198145c876fbfab4855fa43faaf292d10c73f144619c34714f97e | Triage

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/11/2022, 03:39

Sharing

Report Analysis Logs

General

Target

file.exe
Size

73KB
MD5

9f3d2f161ab12215d8127143188fadc6
SHA1

2fa3f6914fe95ebd19d6395fed3296dee351ec56
SHA256

42ff33d8a2c198145c876fbfab4855fa43faaf292d10c73f144619c34714f97e
SHA512

b2cad85987c0b431323396a68a609422a7665033f25f43fb7e2430b192eafe00d375ce8b518385b962d0b4601ac170184096f5b5015e536c5cf0419fa22c5d61
SSDEEP

1536:4WmCpPvpguzG3Uj/mvaVaDLGnsyjLixPd:4W3PLzUSmvaVaDLGnsyPA

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1996	752	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	752	file.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 1996	752	file.exe	28
PID 752 wrote to memory of 1996	752	file.exe	28
PID 752 wrote to memory of 1996	752	file.exe	28
PID 752 wrote to memory of 1996	752	file.exe	28

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 1088
  2⤵
  - Program crash
  PID:1996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/752-54-0x00000000011F0000-0x0000000001206000-memory.dmp

Filesize
88KB

Download
memory/752-55-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/752-56-0x0000000075241000-0x0000000075243000-memory.dmp

Filesize
8KB

Download