1449fce2d52bd0dd8dc422a0c5d17f4ab20af9615e0620d0e0992dca62a27ee9 | Triage

Analysis

max time kernel
101s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2023, 09:39

Sharing

Report Analysis Logs

General

Target

eh.exe
Size

35KB
MD5

ea24f9297d11023076d9b10de14d15ec
SHA1

7a399ba2d7bc9b878d457a98bb34c325fb0ed164
SHA256

7a17c25be0c3e70aaea4f8987d981ea2042fdea62a13d60c430a0fc58b86db1f
SHA512

f1c63394a47510cfd396c802c4fc06c5bf3cd83ec27815326e2819b96dbeb19b62ed8ff8984cff07e9e4211a8dcd5c06339cc91ae8dcfa794fb717d302544e13
SSDEEP

768:g2B3kHsILvVTqUf7oViM9CCF9rnNR3u0+6C1nbcuyD7U8u:PeM9ICpPF9rNoyCnouy8H

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4228-133-0x0000000000400000-0x0000000000426000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4732	4228	WerFault.exe	82

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4228	eh.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4228	eh.exe

C:\Users\Admin\AppData\Local\Temp\eh.exe
"C:\Users\Admin\AppData\Local\Temp\eh.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 292
  2⤵
  - Program crash
  PID:4732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4228 -ip 4228
1⤵
PID:1264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4228-133-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download