Analysis
- max time kernel
48s - max time network
46s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
07/02/2023, 09:07
General
- Target FB-108N & FB-108NK 詢價 - 田勤.exe
- Size 1010KB
- Sample230207-k3a3dsaf83
- SHA256 331c2f4bff1f7b905846094bf883b8d67efa9f6698c57169bff85fd4382da009
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\FB-108N & FB-108NK 詢價 - 田勤.exe"C:\Users\Admin\AppData\Local\Temp\FB-108N & FB-108NK 詢價 - 田勤.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 7042⤵
- Program crash
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/752-54-0x0000000000890000-0x0000000000992000-memory.dmp
memory/752-55-0x0000000075D01000-0x0000000075D03000-memory.dmp
memory/752-56-0x00000000002C0000-0x00000000002D4000-memory.dmp
memory/752-57-0x0000000000580000-0x000000000058C000-memory.dmp
memory/752-58-0x0000000006050000-0x0000000006116000-memory.dmp
memory/752-59-0x0000000005280000-0x00000000052E8000-memory.dmp