19fa93805291d9f16dc348ea35300aeb6ffd9bbee855948fa351c6c6791fc821 | Triage

Analysis

max time kernel
142s
max time network
148s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/02/2023, 13:59

Sharing

Report Analysis Logs

General

Target

00000000.exe
Size

7KB
MD5

f28cc09c077e067d36f7f69629ee6297
SHA1

bebb8b40f38f66df1644edee949adecb474fb9b7
SHA256

19fa93805291d9f16dc348ea35300aeb6ffd9bbee855948fa351c6c6791fc821
SHA512

20bab9ef2c31f8e40ef92ae8683ed7672e28da854aa1e9b855ec1cf6a7ac893a2fbc10a318f12140a9cc6b3b9caa26e391d610527e71da53e91370069f997b71
SSDEEP

96:+wph816+leOL2LPQYHFZiQBq58xY+s6koCvP9ZdxzNt:Bph816+leOSrQYHLZI58e+sHo4rJ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1736	1216	WerFault.exe	2

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1216	00000000.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 1736	1216	00000000.exe	28
PID 1216 wrote to memory of 1736	1216	00000000.exe	28
PID 1216 wrote to memory of 1736	1216	00000000.exe	28
PID 1216 wrote to memory of 1736	1216	00000000.exe	28

C:\Users\Admin\AppData\Local\Temp\00000000.exe
"C:\Users\Admin\AppData\Local\Temp\00000000.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 1200
  2⤵
  - Program crash
  PID:1736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1216-54-0x00000000009B0000-0x00000000009B8000-memory.dmp

Filesize
32KB

Download
memory/1216-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download