5f062e4d8beaf7bc3b606afe8d058580b38ce33393b89a23db757ab4cf4f4576 | Triage

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
14-11-2022 09:21

Sharing

Report Analysis Logs

General

Target

Consulta adjunta.exe
Size

43KB
MD5

b1f86158fada0496bed842e21913c161
SHA1

f56f230c577760aa6e8940f8582e72a9513850b5
SHA256

5f062e4d8beaf7bc3b606afe8d058580b38ce33393b89a23db757ab4cf4f4576
SHA512

8616e1de2b3fe6364da08b4860f70579f1140a1a9ac1c70d7f398917c7f7dba7b32da9fb64a191075f248f0451b3899c971629332e21ad816a8a96ed1b4ec287
SSDEEP

768:R0VcgMMJvtAG33fztRcb+AuuyXZpI7UyP2WlMzGE6h:R0jv5nJRBA03I7Pur4h

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1756	1980	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1980	Consulta adjunta.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1756	1980	Consulta adjunta.exe	28
PID 1980 wrote to memory of 1756	1980	Consulta adjunta.exe	28
PID 1980 wrote to memory of 1756	1980	Consulta adjunta.exe	28
PID 1980 wrote to memory of 1756	1980	Consulta adjunta.exe	28

C:\Users\Admin\AppData\Local\Temp\Consulta adjunta.exe
"C:\Users\Admin\AppData\Local\Temp\Consulta adjunta.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 1148
  2⤵
  - Program crash
  PID:1756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1980-54-0x00000000010D0000-0x00000000010E4000-memory.dmp

Filesize
80KB

Download
memory/1980-55-0x0000000076031000-0x0000000076033000-memory.dmp

Filesize
8KB

Download