6d3397c687aea5017b90a5e96adc6fbfb0429d56a8b2ead1f1d4273994952379 | Triage

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/11/2022, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6f53598b9c19b30a0cf3ff0432301708.exe
Size

72KB
MD5

6f53598b9c19b30a0cf3ff0432301708
SHA1

4bd8e67e468adfbfddd9e5a1e47fdf318bf9a31b
SHA256

6d3397c687aea5017b90a5e96adc6fbfb0429d56a8b2ead1f1d4273994952379
SHA512

e655648f950b90261fd2b54be1ebfee9780ff466351d1cc4b1a675c41329fc5eae62f20ccb9423d3ee4e3457c7a8ed63b14bc2e30f205a4512122301ce2d1541
SSDEEP

1536:7BKK5PX8Q01Hb20oJ0fekpamVGfhCW7j:lKSx0177ouekpamVGfhCW7j

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1628	2016	WerFault.exe	25

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2016	6f53598b9c19b30a0cf3ff0432301708.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1628	2016	6f53598b9c19b30a0cf3ff0432301708.exe	26
PID 2016 wrote to memory of 1628	2016	6f53598b9c19b30a0cf3ff0432301708.exe	26
PID 2016 wrote to memory of 1628	2016	6f53598b9c19b30a0cf3ff0432301708.exe	26
PID 2016 wrote to memory of 1628	2016	6f53598b9c19b30a0cf3ff0432301708.exe	26

C:\Users\Admin\AppData\Local\Temp\6f53598b9c19b30a0cf3ff0432301708.exe
"C:\Users\Admin\AppData\Local\Temp\6f53598b9c19b30a0cf3ff0432301708.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 1184
  2⤵
  - Program crash
  PID:1628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2016-54-0x0000000001030000-0x0000000001048000-memory.dmp

Filesize
96KB

Download
memory/2016-55-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2016-56-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download