1767126f35737c858d2d4abf0c5b109447b3a25eac6ab98782f9528fc1d88179 | Triage

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 12:44

Sharing

Report Analysis Logs

General

Target

369316e575cc105bf300d63226392410.exe
Size

65KB
MD5

369316e575cc105bf300d63226392410
SHA1

aeb9116975d7bfeb001d9ad5a2bc0590336ea9d9
SHA256

1767126f35737c858d2d4abf0c5b109447b3a25eac6ab98782f9528fc1d88179
SHA512

b8ba53037685de3c5a0924eae1c0d2d296a63341ba1ef6a71a0570c880031c194b37e68385f1c37a4c29ba5e0eb98bf8f0856d6f0e29b1b1667858f374ae5cd5
SSDEEP

1536:jtf77AEBaoVsz16Anz3pIFhy55KChEE1o3q3G/h95:jOEBaoVsx6An7ucBeq6

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2728	369316e575cc105bf300d63226392410.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 2856	2728	369316e575cc105bf300d63226392410.exe	30
PID 2728 wrote to memory of 2856	2728	369316e575cc105bf300d63226392410.exe	30
PID 2728 wrote to memory of 2856	2728	369316e575cc105bf300d63226392410.exe	30
PID 2728 wrote to memory of 2856	2728	369316e575cc105bf300d63226392410.exe	30

C:\Users\Admin\AppData\Local\Temp\369316e575cc105bf300d63226392410.exe
"C:\Users\Admin\AppData\Local\Temp\369316e575cc105bf300d63226392410.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\SysWOW64\arp.exe
  "C:\Windows\System32\arp.exe" -a
  2⤵
  PID:2856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2728-1-0x0000000074A90000-0x000000007517E000-memory.dmp

Filesize
6.9MB

Download
memory/2728-0-0x00000000010F0000-0x0000000001106000-memory.dmp

Filesize
88KB

Download
memory/2728-2-0x0000000004910000-0x0000000004950000-memory.dmp

Filesize
256KB

Download
memory/2728-3-0x0000000074A90000-0x000000007517E000-memory.dmp

Filesize
6.9MB

Download