daa8802270996f3d7b4835fd9fba42da054ad1a58403854c0f86b0666c631ac1 | Triage

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2022, 11:26

Sharing

Report Analysis Logs

General

Target

109.exe
Size

1.5MB
MD5

48b5f870cd52e63adff35391961974b5
SHA1

b355a7ea90387606c41b9641c9c7857250335ed9
SHA256

7a84c0090ef3aa1210ff677298007ab3c6a626b047473f6f4854955cd4e0213f
SHA512

a3245fcfc944514a0a28e9e0887eeba7b971fdc2a7c5168e4b3311f38a2bdc2692800fc7e42e64938e7ec91b9f4dcdb57f77d33f5dcc2e36e8590c065e2f698f
SSDEEP

24576:w6LGRV7EMd5A5/B81TJvWkw1RaksEloH6KWUIuYYTcrL7VF3JOkK74gYx:w6qRV7EMd5A561TKTPTsW8A34NYx

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4356 set thread context of 1104	4356	109.exe	81

Program crash 1 IoCs

pid	pid_target	Process	procid_target
860	1104	WerFault.exe	81

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4356	109.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1104	109.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 1104	4356	109.exe	81
PID 4356 wrote to memory of 1104	4356	109.exe	81
PID 4356 wrote to memory of 1104	4356	109.exe	81
PID 4356 wrote to memory of 1104	4356	109.exe	81
PID 4356 wrote to memory of 1104	4356	109.exe	81
PID 4356 wrote to memory of 1104	4356	109.exe	81
PID 4356 wrote to memory of 1104	4356	109.exe	81
PID 4356 wrote to memory of 1104	4356	109.exe	81

C:\Users\Admin\AppData\Local\Temp\109.exe
"C:\Users\Admin\AppData\Local\Temp\109.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Users\Admin\AppData\Local\Temp\109.exe
  C:\Users\Admin\AppData\Local\Temp\109.exe
  2⤵
  - Suspicious use of UnmapMainImage
  PID:1104
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 12
    3⤵
    - Program crash
    PID:860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1104 -ip 1104
1⤵
PID:4668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4356-132-0x0000000074F90000-0x0000000075541000-memory.dmp

Filesize
5.7MB

Download
memory/4356-135-0x0000000074F90000-0x0000000075541000-memory.dmp

Filesize
5.7MB

Download