3065df9608a4d29f1cc7f4934ecd7445d83f6e5ecde5b7f8ecca656a7c384657 | Triage

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/02/2023, 19:28

Sharing

Report Analysis Logs

General

Target

a5a4b316cc349db892a27c9b5429dd4e.exe
Size

29KB
MD5

a5a4b316cc349db892a27c9b5429dd4e
SHA1

18e025e751a08d3af69bf8fbe26939bfa96c1668
SHA256

3065df9608a4d29f1cc7f4934ecd7445d83f6e5ecde5b7f8ecca656a7c384657
SHA512

a22fe0c4890acd1e72f3fc9fb95f22b4032473c37e86613ed6a7cde529286703132f186946294225b74ec8a69358d71a617ccda7bcaf5cf1603cf954d10bf7d6
SSDEEP

384:IUsQruz2H58mIajRgJTQo5pkvwKwq6u/FB:IGr42Z8c9vn

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\discord.exe	a5a4b316cc349db892a27c9b5429dd4e.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1564	1392	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1392	a5a4b316cc349db892a27c9b5429dd4e.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 1564	1392	a5a4b316cc349db892a27c9b5429dd4e.exe	28
PID 1392 wrote to memory of 1564	1392	a5a4b316cc349db892a27c9b5429dd4e.exe	28
PID 1392 wrote to memory of 1564	1392	a5a4b316cc349db892a27c9b5429dd4e.exe	28
PID 1392 wrote to memory of 1564	1392	a5a4b316cc349db892a27c9b5429dd4e.exe	28

C:\Users\Admin\AppData\Local\Temp\a5a4b316cc349db892a27c9b5429dd4e.exe
"C:\Users\Admin\AppData\Local\Temp\a5a4b316cc349db892a27c9b5429dd4e.exe"
1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 1040
  2⤵
  - Program crash
  PID:1564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1392-54-0x0000000000880000-0x000000000088E000-memory.dmp

Filesize
56KB

Download
memory/1392-55-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download