d0868cfa2f8d12b1f4fec7473e5f0baad751b77caf178aef546e5126b60278ab | Triage

Analysis

max time kernel
30s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
09-11-2022 21:32

Sharing

Report Analysis Logs

General

Target

INV000827365678.exe
Size

436KB
MD5

b41b1dcba357b9cae74f5a3a06d5faf4
SHA1

3bcacaad8622d6a0a3463060c1f4ac7416c0affc
SHA256

d0868cfa2f8d12b1f4fec7473e5f0baad751b77caf178aef546e5126b60278ab
SHA512

8f43eebaf082c6b9ba561c28b1abd1f04409e38b7c3ae182c7af0dc8a8578fab743e67773ba4282d9a1c5b409489f46da0979e328c30734d9670dae05890015f
SSDEEP

12288:9rY1Dr2ChdBjliyVAxTG3ilBB8WShCmaqpyGTYBVhm:hY1Dr2ChNVAwSNKCmay

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

988 112 WerFault.exe INV000827365678.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

INV000827365678.exe

pid process

112 INV000827365678.exe
112 INV000827365678.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

INV000827365678.exe

description pid process

Token: SeDebugPrivilege 112 INV000827365678.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

INV000827365678.exe

description	pid	process	target process
PID 112 wrote to memory of 988	112	INV000827365678.exe	WerFault.exe
PID 112 wrote to memory of 988	112	INV000827365678.exe	WerFault.exe
PID 112 wrote to memory of 988	112	INV000827365678.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\INV000827365678.exe
"C:\Users\Admin\AppData\Local\Temp\INV000827365678.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:112

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 112 -s 592
2⤵
- Program crash
PID:988

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/112-54-0x0000000000F00000-0x0000000000F72000-memory.dmp

Filesize
456KB

Download
memory/988-55-0x0000000000000000-mapping.dmp

Download