a1bea89c82d571bc5f530ad5dd272f2ed14d36de495a81fc68c4ccf78f2a7914 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 02:56

Sharing

Report Analysis Logs

General

Target

2564c5510ae48a4f118d154941c717c8.exe
Size

24KB
MD5

2564c5510ae48a4f118d154941c717c8
SHA1

5f5da429f63d3fe3d4550e5e4eef0cbb0edb0adb
SHA256

a1bea89c82d571bc5f530ad5dd272f2ed14d36de495a81fc68c4ccf78f2a7914
SHA512

7424bbecb636dba54ebadb64af204ca2166d72a474945104ea06dee7c2dfd576512e87685a1804abc10b58956f76e46996be9cdb2e69c06096f6c29730f931f1
SSDEEP

384:fZsXQLcmh4yWGT9jU6nC3S1U5cg3eNuk6P+2Sd:6XQLcmh4TQDnC3LcUeNkPl

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1832	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
1992	2564c5510ae48a4f118d154941c717c8.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1992	2564c5510ae48a4f118d154941c717c8.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1832	1992	2564c5510ae48a4f118d154941c717c8.exe	16
PID 1992 wrote to memory of 1832	1992	2564c5510ae48a4f118d154941c717c8.exe	16
PID 1992 wrote to memory of 1832	1992	2564c5510ae48a4f118d154941c717c8.exe	16
PID 1992 wrote to memory of 1832	1992	2564c5510ae48a4f118d154941c717c8.exe	16

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2564C5~1.EXE > nul
1⤵
- Deletes itself
PID:1832

C:\Users\Admin\AppData\Local\Temp\2564c5510ae48a4f118d154941c717c8.exe
"C:\Users\Admin\AppData\Local\Temp\2564c5510ae48a4f118d154941c717c8.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1992-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1992-4-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download