ee444f87cd33352f2bb9b9bc1a15ff2142613b78553343027f39d5c44128fee3 | Triage

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
07-06-2023 14:32

Sharing

Report Analysis Logs

General

Target

file.exe
Size

21KB
MD5

3803666407877f6bc945425ce874653d
SHA1

fc824bd0430c2e70e9bfad65a70e78bf059aa82e
SHA256

ee444f87cd33352f2bb9b9bc1a15ff2142613b78553343027f39d5c44128fee3
SHA512

c223764ffb89b13a301904593045a5a5ae7b4eeb0d4f4e21c2a53e072d3d12f3e654f4a750a71fbb9679206c8682dc0664ff167ff142d03adb110e956923bdd2
SSDEEP

384:TAuZSCDIElD/AW6zyeUci3BBcWnYNBa20cDGXwfwqppg6+KnhkMSaTFTD:xlD/22eUcusWY6gZYUTJD

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
804	2000	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2000	file.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 804	2000	file.exe	28
PID 2000 wrote to memory of 804	2000	file.exe	28
PID 2000 wrote to memory of 804	2000	file.exe	28

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2000 -s 1060
  2⤵
  - Program crash
  PID:804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2000-54-0x00000000013B0000-0x00000000013BA000-memory.dmp

Filesize
40KB

Download
memory/2000-55-0x000000001B1F0000-0x000000001B270000-memory.dmp

Filesize
512KB

Download
memory/2000-56-0x000000001B1F0000-0x000000001B270000-memory.dmp

Filesize
512KB

Download