9f38198ca55e984bd65f7a324853411d19a3426ac0455f64b76eb3aa2c1d85e8 | Triage

Resubmissions

12-11-2022 16:17

221112-trfyyagf53 10

12-11-2022 16:00

221112-tfm8wage94 10

Analysis

max time kernel
46s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
12-11-2022 16:00

Sharing

Report Analysis Logs

General

Target

statement_docx.exe
Size

1.7MB
MD5

2aedd0caff110812c17de4072cde09ba
SHA1

a2850f291012d07ef1acedbb9ac24884fb8db8d0
SHA256

9f38198ca55e984bd65f7a324853411d19a3426ac0455f64b76eb3aa2c1d85e8
SHA512

b83a5576522d128fe9ad5d9e579403fb96b69afef97a4440527c9e534e998bb38537bcb6fb64eddc7ca7ca92385621b0a48bc90abb2854c6f504211084d540e0
SSDEEP

49152:cSJ9EoE2fT7om1nLbta4BN/0yLhsLZNhONEIwS:cc1PxBLGtNENBwS

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1220 1308 WerFault.exe statement_docx.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

statement_docx.exe

pid process

1308 statement_docx.exe
1308 statement_docx.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

statement_docx.exe

description pid process

Token: SeDebugPrivilege 1308 statement_docx.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

statement_docx.exe

description	pid	process	target process
PID 1308 wrote to memory of 1220	1308	statement_docx.exe	WerFault.exe
PID 1308 wrote to memory of 1220	1308	statement_docx.exe	WerFault.exe
PID 1308 wrote to memory of 1220	1308	statement_docx.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\statement_docx.exe
"C:\Users\Admin\AppData\Local\Temp\statement_docx.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1308

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1308 -s 552
2⤵
- Program crash
PID:1220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1220-55-0x0000000000000000-mapping.dmp

Download
memory/1308-54-0x0000000000B20000-0x0000000000CD6000-memory.dmp

Filesize
1.7MB

Download