Overview

overview

7

Static

static

1

PSNStuff-D...b2.exe

windows7-x64

3

PSNStuff-D...b2.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    31s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    14/03/2023, 19:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    PSNStuff-Database-Hola-Browser-Setup-Inst-Agreed-C-Mmdb2.exe

  • Size

    1.4MB

  • MD5

    7f5ff592b91e28a827303ad81a381f35

  • SHA1

    2f840eda2b3e0c409b3dbd00fcdc68565f861162

  • SHA256

    5b3419ae552d690414c96c0c984bdc4236e4d8c33c2aad61b796ed9ba734a594

  • SHA512

    311c86d47fbd7b2e078aa4c6d5d8a8c3feaabcceb360e56cf82c7e5a3c42107c1c9fbddfd1b9b7e602811869e881b82edf03a68ac3ae64061aafcb70db95cfe9

  • SSDEEP

    24576:gHp+nUL+L8m657w6ZBLmkitKqBCjC0PDgM5A4woG4O:gH/yVV1BCjBkZ

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PSNStuff-Database-Hola-Browser-Setup-Inst-Agreed-C-Mmdb2.exe
    "C:\Users\Admin\AppData\Local\Temp\PSNStuff-Database-Hola-Browser-Setup-Inst-Agreed-C-Mmdb2.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:908
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 908 -s 1248
      2⤵
      • Program crash
      PID:848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/908-54-0x0000000000A70000-0x0000000000BD8000-memory.dmp

    Filesize

    1.4MB

    Download

  • memory/908-55-0x0000000002010000-0x0000000002050000-memory.dmp

    Filesize

    256KB

    Download