6f723124d92d27b0363d6a4bbcc874f3eedfee51d0848fba53fc39c268965f65 | Triage

Analysis

max time kernel
8s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
04-03-2023 19:35

Sharing

Report Analysis Logs

General

Target

808GangTweakerReloaded.exe
Size

181KB
MD5

e38d9017c8b7b39ce60356ede50d464e
SHA1

fc2a41754f950e9e5ee4e02a0df6c699f9a48f40
SHA256

6f723124d92d27b0363d6a4bbcc874f3eedfee51d0848fba53fc39c268965f65
SHA512

03ad1d6b0a6fd6c8acd3ed1db109b4d40adf46b49f5d969cff70ce8774eebc6beb9c6241f197f6b1abd5b2e6f1f93be241ca62e1a244c2e9424993fb2ac4cf29
SSDEEP

3072:2NMHRDDt4lBhYI1+c+Ary73c+Ary7KuB1:jxDc7AcNgcNcv

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1720	1260	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1260	808GangTweakerReloaded.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 1720	1260	808GangTweakerReloaded.exe	28
PID 1260 wrote to memory of 1720	1260	808GangTweakerReloaded.exe	28
PID 1260 wrote to memory of 1720	1260	808GangTweakerReloaded.exe	28
PID 1260 wrote to memory of 1720	1260	808GangTweakerReloaded.exe	28

C:\Users\Admin\AppData\Local\Temp\808GangTweakerReloaded.exe
"C:\Users\Admin\AppData\Local\Temp\808GangTweakerReloaded.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 568
  2⤵
  - Program crash
  PID:1720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1260-54-0x00000000001B0000-0x00000000001E6000-memory.dmp

Filesize
216KB

Download
memory/1260-55-0x00000000049D0000-0x0000000004A10000-memory.dmp

Filesize
256KB

Download