78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce

General

Target

78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe
Size

494KB
MD5

5e86e15a56455a7b230d2a934ad129a5
SHA1

6b0a1beffe90cf58d1e442612458d18b59a852a4
SHA256

78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce
SHA512

6dc0c23f825a36db50adf41795a2da3ae962ebd9eef07a923e629a8a32ac2a7aff87e19f1682a259cde6aa83c13c41e7e5ce4f7988680feaaedbe049208401e5
SSDEEP

12288:wWwjzdKu2piK6lVOx7j5S8U9a/tUvuNX7Y:Pwjzd+gE99XAC

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe

description	pid	process	target process
PID 2124 set thread context of 2208	2124	78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe	78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2704 2208 WerFault.exe 78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe

pid process

2124 78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe

description pid process

Token: SeDebugPrivilege 2124 78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe

pid	pid_target	process	target process
2704	2208	WerFault.exe	78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe

pid	process
2124	78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe

description	pid	process
Token: SeDebugPrivilege	2124	78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe

C:\Users\Admin\AppData\Local\Temp\78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe
"C:\Users\Admin\AppData\Local\Temp\78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2124

C:\Users\Admin\AppData\Local\Temp\78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe
C:\Users\Admin\AppData\Local\Temp\78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:2208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 164
3⤵
- Program crash
PID:2704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2124-0-0x0000000000DB0000-0x0000000000E32000-memory.dmp

Filesize
520KB

Download
memory/2124-1-0x0000000074560000-0x0000000074C4E000-memory.dmp

Filesize
6.9MB

Download
memory/2124-2-0x0000000000C40000-0x0000000000C80000-memory.dmp

Filesize
256KB

Download
memory/2124-3-0x0000000000990000-0x00000000009D6000-memory.dmp

Filesize
280KB

Download
memory/2124-4-0x0000000000620000-0x0000000000666000-memory.dmp

Filesize
280KB

Download
memory/2124-5-0x00000000009E0000-0x0000000000A14000-memory.dmp

Filesize
208KB

Download
memory/2124-6-0x0000000000CC0000-0x0000000000D0C000-memory.dmp

Filesize
304KB

Download
memory/2124-20-0x0000000074560000-0x0000000074C4E000-memory.dmp

Filesize
6.9MB

Download
memory/2208-9-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2208-12-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2208-10-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2208-17-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2208-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2208-14-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2208-13-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2208-7-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2208-19-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download

description	pid	process	target process
PID 2124 wrote to memory of 2208	2124	78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe	78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe
PID 2124 wrote to memory of 2208	2124	78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe	78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe
PID 2124 wrote to memory of 2208	2124	78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe	78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe
PID 2124 wrote to memory of 2208	2124	78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe	78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe
PID 2124 wrote to memory of 2208	2124	78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe	78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe
PID 2124 wrote to memory of 2208	2124	78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe	78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe
PID 2124 wrote to memory of 2208	2124	78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe	78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe
PID 2124 wrote to memory of 2208	2124	78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe	78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe
PID 2124 wrote to memory of 2208	2124	78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe	78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe
PID 2124 wrote to memory of 2208	2124	78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe	78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe
PID 2124 wrote to memory of 2208	2124	78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe	78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe
PID 2208 wrote to memory of 2704	2208	78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe	WerFault.exe
PID 2208 wrote to memory of 2704	2208	78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe	WerFault.exe
PID 2208 wrote to memory of 2704	2208	78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe	WerFault.exe
PID 2208 wrote to memory of 2704	2208	78732997a6c9d975b97da85fc511533d44083a9f9da60dae8393274a59b7bfce_JC.exe	WerFault.exe

Analysis

Sharing