Overview

overview

1

Static

static

d96491007b...3b.exe

windows7-x64

1

d96491007b...3b.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    100s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 12:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d96491007b2d42d9d88fe6e82d1a22efdb6bd04aa235a4831711ea722a537c3b.exe

  • Size

    87KB

  • MD5

    c688cfa2ea2e9bd942157dd9c5c72ba5

  • SHA1

    3442a24aab1b9a3bfe0ac49c5f8d4893347c7e68

  • SHA256

    d96491007b2d42d9d88fe6e82d1a22efdb6bd04aa235a4831711ea722a537c3b

  • SHA512

    3cc9fa6b25f822baef5873fcb0960a214300ca1b2c37b1db62b5c4430d47dcab05ab67277bb82834bbeffc40c35ec038fc17176f22264131a0f44cecb3169e9d

  • SSDEEP

    1536:OgZ+C9ntVhcj0BmpEyI5BI/af/QXWqHGM1QoFmJbBcEdovzAQPBLS+v:ldA+HISf4LEiHrzPBm+v

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d96491007b2d42d9d88fe6e82d1a22efdb6bd04aa235a4831711ea722a537c3b.exe
    "C:\Users\Admin\AppData\Local\Temp\d96491007b2d42d9d88fe6e82d1a22efdb6bd04aa235a4831711ea722a537c3b.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1488
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
      dw20.exe -x -s 496
      2⤵
        PID:1504

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1488-54-0x0000000075C11000-0x0000000075C13000-memory.dmp

      Filesize

      8KB

      Download

    • memory/1488-55-0x0000000074AD0000-0x000000007507B000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/1488-58-0x0000000074AD0000-0x000000007507B000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/1504-56-0x0000000000000000-mapping.dmp

      Download