Analysis

  • max time kernel
    137s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/10/2023, 03:50

General

  • Target

    854F1E97-5DBB-4AA87-A566-33D9012B095E2pdf.exe

  • Size

    7KB

  • MD5

    5f29bcbcb6dd39d9171f817274134915

  • SHA1

    9d1cbb672a2b68d3592e47dfb4e1d0763728d144

  • SHA256

    b0dd78db36781e0070e3f613749814c5167a07afc28a7225d72ec3615c351efd

  • SHA512

    39c2fabec9b3074283aa6c4e1de0c166131a81a830b6863cd3555845a1b8e828980be144a8a551c2b402fb7b921d29d7c8756ad5eb41221e261fcea1854f0628

  • SSDEEP

    96:pd7+uHAUjtCnqaxJ40IbABUL2QZBn2cmL/JZggDCY2wx5ODJzNt:pd7gEtCnn74RUMrnza3DCY2wfODr

Score
3/10

Malware Config

Signatures

  • Program crash 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\854F1E97-5DBB-4AA87-A566-33D9012B095E2pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\854F1E97-5DBB-4AA87-A566-33D9012B095E2pdf.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1848
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 1952
      2⤵
      • Program crash
      PID:1372
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 1952
      2⤵
      • Program crash
      PID:2532
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1848 -ip 1848
    1⤵
      PID:5016
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1848 -ip 1848
      1⤵
        PID:796

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/1848-0-0x0000000074CB0000-0x0000000075460000-memory.dmp

              Filesize

              7.7MB

            • memory/1848-1-0x0000000000570000-0x0000000000578000-memory.dmp

              Filesize

              32KB

            • memory/1848-2-0x00000000054F0000-0x0000000005A94000-memory.dmp

              Filesize

              5.6MB

            • memory/1848-3-0x0000000005040000-0x0000000005050000-memory.dmp

              Filesize

              64KB

            • memory/1848-4-0x0000000074CB0000-0x0000000075460000-memory.dmp

              Filesize

              7.7MB

            • memory/1848-5-0x0000000005040000-0x0000000005050000-memory.dmp

              Filesize

              64KB

            • memory/1848-6-0x0000000074CB0000-0x0000000075460000-memory.dmp

              Filesize

              7.7MB