ec130a284028c082a22e8bb7d535e40a9b12f084270ec799706176abdc4431dd | Triage

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 07:41

Sharing

Report Analysis Logs

General

Target

1268d9fcbd98b5703a69a578d4b2391a.exe
Size

109KB
MD5

1268d9fcbd98b5703a69a578d4b2391a
SHA1

8d99132a9fe1eb8b9cd7b73911ce3ff25ea9be5f
SHA256

ec130a284028c082a22e8bb7d535e40a9b12f084270ec799706176abdc4431dd
SHA512

e3cad72409dd35216947bd27f3d4b14b70504a6329a7ac8619a9775bb6b0c6508f38e86de3333f8ef913a20fcfcd3141f7174db0dbee2235723ec6f0e10aa930
SSDEEP

3072:YDTVj8QsBpxfnYJ/sMYk9nfN5FLu1BFRFPMrja:YDJj8QIesMxnfDFLu+

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2684	2976	WerFault.exe	14

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2976	1268d9fcbd98b5703a69a578d4b2391a.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2684	2976	1268d9fcbd98b5703a69a578d4b2391a.exe	28
PID 2976 wrote to memory of 2684	2976	1268d9fcbd98b5703a69a578d4b2391a.exe	28
PID 2976 wrote to memory of 2684	2976	1268d9fcbd98b5703a69a578d4b2391a.exe	28
PID 2976 wrote to memory of 2684	2976	1268d9fcbd98b5703a69a578d4b2391a.exe	28

C:\Users\Admin\AppData\Local\Temp\1268d9fcbd98b5703a69a578d4b2391a.exe
"C:\Users\Admin\AppData\Local\Temp\1268d9fcbd98b5703a69a578d4b2391a.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 548
  2⤵
  - Program crash
  PID:2684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2976-1-0x00000000746C0000-0x0000000074DAE000-memory.dmp

Filesize
6.9MB

Download
memory/2976-0-0x0000000000CA0000-0x0000000000CC0000-memory.dmp

Filesize
128KB

Download
memory/2976-2-0x00000000746C0000-0x0000000074DAE000-memory.dmp

Filesize
6.9MB

Download