43a8fe38ab8ff45d22935391ee2487608fb4d8efc9a0d7a3cef92e09c1395615 | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 09:39

Sharing

Report Analysis Logs

General

Target

45e777c57811644d3b4f2361935d47bd.exe
Size

460KB
MD5

45e777c57811644d3b4f2361935d47bd
SHA1

91d50074e2fae9baf5c7bcbc9c6b3a20c0f2a578
SHA256

43a8fe38ab8ff45d22935391ee2487608fb4d8efc9a0d7a3cef92e09c1395615
SHA512

f7ba4f92172d328b06c57d91bd71be3235d2bf8de34fed1e35f3930982359e991cf492e38732ab4af0fdde431bad0e5a2061756b79a6495e3e1dc3b165a0bc11
SSDEEP

6144:wvLpPV4I/w589NjIRmqZHF7S1M4IBprBnBsf/W2T6:wvLpPnNu7Sm400Z+

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1312	2236	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2236	45e777c57811644d3b4f2361935d47bd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 1312	2236	45e777c57811644d3b4f2361935d47bd.exe	28
PID 2236 wrote to memory of 1312	2236	45e777c57811644d3b4f2361935d47bd.exe	28
PID 2236 wrote to memory of 1312	2236	45e777c57811644d3b4f2361935d47bd.exe	28
PID 2236 wrote to memory of 1312	2236	45e777c57811644d3b4f2361935d47bd.exe	28

C:\Users\Admin\AppData\Local\Temp\45e777c57811644d3b4f2361935d47bd.exe
"C:\Users\Admin\AppData\Local\Temp\45e777c57811644d3b4f2361935d47bd.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 292
  2⤵
  - Program crash
  PID:1312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2236-0-0x0000000000940000-0x00000000009B5000-memory.dmp

Filesize
468KB

Download
memory/2236-1-0x0000000000940000-0x00000000009B5000-memory.dmp

Filesize
468KB

Download