cb17971c69696d81a364f55879b02caae2bd0135d0d1d6bfba48868f7a2f1d30

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
04/11/2023, 03:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e84d471a80ec83eb8af3c140a6e4226b.exe
Size

10KB
MD5

e84d471a80ec83eb8af3c140a6e4226b
SHA1

0fa7ab7b987a21968e212fc6880a8a9221ea183c
SHA256

cb17971c69696d81a364f55879b02caae2bd0135d0d1d6bfba48868f7a2f1d30
SHA512

671afbdc9d7e5999a5dbc80436e74003282f2d1ca75bc6506c7b6c32bec0c9cd8e923e4641a3c4e43b1f406c50fd7adbf8ec56b7ebbad379618f4310da472b0a
SSDEEP

96:L5u1RonGBS0ivS1dbbDsYn6jMX9ps24tEkKa704yUtGSCOSWWC7pEm0/tfulFYzj:lu1dSebnsoqMXbsfHXyU5WC7pcWF6

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1192 set thread context of 1744	1192	e84d471a80ec83eb8af3c140a6e4226b.exe	31

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2888	1744	WerFault.exe	31

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1192	e84d471a80ec83eb8af3c140a6e4226b.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 1744	1192	e84d471a80ec83eb8af3c140a6e4226b.exe	31
PID 1192 wrote to memory of 1744	1192	e84d471a80ec83eb8af3c140a6e4226b.exe	31
PID 1192 wrote to memory of 1744	1192	e84d471a80ec83eb8af3c140a6e4226b.exe	31
PID 1192 wrote to memory of 1744	1192	e84d471a80ec83eb8af3c140a6e4226b.exe	31
PID 1192 wrote to memory of 1744	1192	e84d471a80ec83eb8af3c140a6e4226b.exe	31
PID 1192 wrote to memory of 1744	1192	e84d471a80ec83eb8af3c140a6e4226b.exe	31
PID 1192 wrote to memory of 1744	1192	e84d471a80ec83eb8af3c140a6e4226b.exe	31
PID 1192 wrote to memory of 1744	1192	e84d471a80ec83eb8af3c140a6e4226b.exe	31
PID 1192 wrote to memory of 1744	1192	e84d471a80ec83eb8af3c140a6e4226b.exe	31
PID 1192 wrote to memory of 1744	1192	e84d471a80ec83eb8af3c140a6e4226b.exe	31
PID 1192 wrote to memory of 1744	1192	e84d471a80ec83eb8af3c140a6e4226b.exe	31
PID 1744 wrote to memory of 2888	1744	e84d471a80ec83eb8af3c140a6e4226b.exe	32
PID 1744 wrote to memory of 2888	1744	e84d471a80ec83eb8af3c140a6e4226b.exe	32
PID 1744 wrote to memory of 2888	1744	e84d471a80ec83eb8af3c140a6e4226b.exe	32
PID 1744 wrote to memory of 2888	1744	e84d471a80ec83eb8af3c140a6e4226b.exe	32

C:\Users\Admin\AppData\Local\Temp\e84d471a80ec83eb8af3c140a6e4226b.exe
"C:\Users\Admin\AppData\Local\Temp\e84d471a80ec83eb8af3c140a6e4226b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Users\Admin\AppData\Local\Temp\e84d471a80ec83eb8af3c140a6e4226b.exe
  C:\Users\Admin\AppData\Local\Temp\e84d471a80ec83eb8af3c140a6e4226b.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 160
    3⤵
    - Program crash
    PID:2888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1192-8-0x0000000004860000-0x00000000048A0000-memory.dmp

Filesize
256KB

Download
memory/1192-3-0x0000000005800000-0x0000000005878000-memory.dmp

Filesize
480KB

Download
memory/1192-2-0x0000000004860000-0x00000000048A0000-memory.dmp

Filesize
256KB

Download
memory/1192-22-0x0000000073FF0000-0x00000000746DE000-memory.dmp

Filesize
6.9MB

Download
memory/1192-4-0x0000000004480000-0x00000000044E0000-memory.dmp

Filesize
384KB

Download
memory/1192-5-0x0000000005110000-0x0000000005170000-memory.dmp

Filesize
384KB

Download
memory/1192-6-0x0000000004060000-0x00000000040AC000-memory.dmp

Filesize
304KB

Download
memory/1192-7-0x0000000073FF0000-0x00000000746DE000-memory.dmp

Filesize
6.9MB

Download
memory/1192-1-0x0000000073FF0000-0x00000000746DE000-memory.dmp

Filesize
6.9MB

Download
memory/1192-0-0x0000000000AA0000-0x0000000000AA8000-memory.dmp

Filesize
32KB

Download
memory/1744-11-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1744-12-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1744-14-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1744-15-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1744-16-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1744-19-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1744-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1744-21-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1744-9-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads