cc3e4dbf0ff344d66a39066a453f0dd52160c46fff4ce9d9abc7b0f9e22552da | Triage

Analysis

max time kernel
35s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
10-06-2023 09:23

Sharing

Report Analysis Logs

General

Target

Task_1.exe
Size

1.6MB
MD5

7f2ef21170425e699b8fa5fd0f693a9b
SHA1

e8b956a217baf251e9e2781344f97d0c6e270f23
SHA256

cc3e4dbf0ff344d66a39066a453f0dd52160c46fff4ce9d9abc7b0f9e22552da
SHA512

03f635ef1cfab9168e6c52cb3b5d8aa8864d350a85bc936f75fbbd16ba6b80681a8e8d0e15389a24c7182ec41b330028eadc88823823d97d61d90496ff5c979c
SSDEEP

24576:0GZSAAt2nt0G4KAnZlACIej7zM2tjc1Vs:ZZSAtl4KAzACIejDc

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
652	920	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	920	Task_1.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 920 wrote to memory of 652	920	Task_1.exe	29
PID 920 wrote to memory of 652	920	Task_1.exe	29
PID 920 wrote to memory of 652	920	Task_1.exe	29
PID 920 wrote to memory of 652	920	Task_1.exe	29

C:\Users\Admin\AppData\Local\Temp\Task_1.exe
"C:\Users\Admin\AppData\Local\Temp\Task_1.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 1276
  2⤵
  - Program crash
  PID:652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/920-54-0x0000000001190000-0x0000000001336000-memory.dmp

Filesize
1.6MB

Download
memory/920-55-0x0000000000500000-0x0000000000540000-memory.dmp

Filesize
256KB

Download
memory/920-56-0x0000000000500000-0x0000000000540000-memory.dmp

Filesize
256KB

Download