f697ca8db88830143b58da766bcbe4ebf31ace7c553dc140e1762436f112d356 | Triage

Analysis

max time kernel
32s
max time network
117s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 17:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

138KB
MD5

71be04d685d8b0731ee3400752a40c89
SHA1

665216991c1d99346e7c0e9db56f1bf8fd16c738
SHA256

f697ca8db88830143b58da766bcbe4ebf31ace7c553dc140e1762436f112d356
SHA512

b3813237aaaea2f89bf1801037ca593515e8100f6adf48fbcdb91cafebb32576acb7cd836d7e329ee5174ec4c4596ff23bea7e5653a5b8c710a345ae31e615ab
SSDEEP

1536:68Y7IzfHe474vcf5xj7hJo0XmVAhvhNldij4ASXxcWI4PLtsMNq4:6OTe9vcf5hhJXvflsjCXxc5

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1760	1620	WerFault.exe	23

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1620	tmp.exe
1620	tmp.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1620	tmp.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 1760	1620	tmp.exe	28
PID 1620 wrote to memory of 1760	1620	tmp.exe	28
PID 1620 wrote to memory of 1760	1620	tmp.exe	28

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1620 -s 1248
  2⤵
  - Program crash
  PID:1760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1620-54-0x0000000000190000-0x00000000001B8000-memory.dmp

Filesize
160KB

Download
memory/1620-55-0x0000000000140000-0x000000000017C000-memory.dmp

Filesize
240KB

Download