1d73a4579f84d59f82e46024175c8bfb283fca301f4a4b3c4de56496cdbbed86 | Triage

Analysis

max time kernel
40s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-12-2022 08:10

Sharing

Report Analysis Logs

General

Target

documents.exe
Size

1.1MB
MD5

7481984fba685e017266b19ac0d8a51c
SHA1

a5b0334df8d078a2817a7ed685dbc5a83e989bb6
SHA256

1d73a4579f84d59f82e46024175c8bfb283fca301f4a4b3c4de56496cdbbed86
SHA512

369f6344fea00c8d8691a70b363a4bdfa310166259865184cd8fd234a0f9c4651d5b239512132403b965e7388576c16a0df8301871566b01e37a0ea76e0d49c3
SSDEEP

12288:WVje0gQR8bXCWRiEsRrKi0DMy4xjhyTlie3cfBtTkX7Y9xiTLCi900JmH2hpv962:WMIyYfiiw3ign8Qc

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
764	1504	WerFault.exe	25

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1504	documents.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1504	documents.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 764	1504	documents.exe	26
PID 1504 wrote to memory of 764	1504	documents.exe	26
PID 1504 wrote to memory of 764	1504	documents.exe	26

C:\Users\Admin\AppData\Local\Temp\documents.exe
"C:\Users\Admin\AppData\Local\Temp\documents.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1504 -s 708
  2⤵
  - Program crash
  PID:764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1504-54-0x0000000000930000-0x0000000000A5A000-memory.dmp

Filesize
1.2MB

Download