Analysis
- max time kernel
112s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
07/02/2023, 09:07
General
- Target FB-108N & FB-108NK 詢價 - 田勤.exe
- Size 1010KB
- Sample230207-k3a3dsaf83
- SHA256 331c2f4bff1f7b905846094bf883b8d67efa9f6698c57169bff85fd4382da009
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\FB-108N & FB-108NK 詢價 - 田勤.exe"C:\Users\Admin\AppData\Local\Temp\FB-108N & FB-108NK 詢價 - 田勤.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 11922⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4816 -ip 48161⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4816-132-0x0000000000250000-0x0000000000352000-memory.dmp
memory/4816-133-0x0000000005160000-0x0000000005704000-memory.dmp
memory/4816-134-0x0000000004C50000-0x0000000004CE2000-memory.dmp
memory/4816-135-0x0000000004BC0000-0x0000000004BCA000-memory.dmp
memory/4816-136-0x0000000008980000-0x0000000008A1C000-memory.dmp