c858e10e29b769ca86445ba1bebdf708e88245da4e96c4afc967818e8293e099 | Triage

Analysis

max time kernel
24s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
27-03-2023 09:33

Sharing

Report Analysis Logs

General

Target

GetPass.exe
Size

52KB
MD5

d25ab00267a9da1944bad9e1115ad428
SHA1

9470006b8763054e14d0e4708a3708e490cacfe9
SHA256

07fc745c29db1e2db61089d8d46299078794d7127120d04c07e0a1ea6933a6df
SHA512

a5906883361a4ce9ee6e3556808f886ee05e84063bbc7e394a33463767e8670eba5cb9f76abef894fcd8607eb3d197ef69e321996246c1f93d463748aaacb206
SSDEEP

768:Feizs4ulZdVEUHw+0QcKbUyQV8gmDzQn3pVok:w3vpHwPQngyOWDCVok

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1736 1304 WerFault.exe GetPass.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

GetPass.exe

description pid process

Token: SeDebugPrivilege 1304 GetPass.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

GetPass.exe

description	pid	process	target process
PID 1304 wrote to memory of 1736	1304	GetPass.exe	WerFault.exe
PID 1304 wrote to memory of 1736	1304	GetPass.exe	WerFault.exe
PID 1304 wrote to memory of 1736	1304	GetPass.exe	WerFault.exe
PID 1304 wrote to memory of 1736	1304	GetPass.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\GetPass.exe
"C:\Users\Admin\AppData\Local\Temp\GetPass.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 164
2⤵
- Program crash
PID:1736

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...