c659feab388a9d980e3e4c86ca394c47f417be80822b0d6ba41915e6f8b5bcb8 | Triage

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 20:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4c5f9acb693ce46e87fcb4b8e6be9310.exe
Size

60KB
MD5

4c5f9acb693ce46e87fcb4b8e6be9310
SHA1

069d80a6770c5a8021d2cb236d81811b2800d763
SHA256

c659feab388a9d980e3e4c86ca394c47f417be80822b0d6ba41915e6f8b5bcb8
SHA512

f2b4fd5167f76ff6b0746bc0ec5fbbc69be26c22af2662d1245fe58d9ed5a106d77b6028cbe41d9964980ea661aa74c81e4605153934d604e1d74546825bd2fd
SSDEEP

1536:AbHVXtRcNmKRMw8wbPnFQ3JIAbL1L6ZjVxz3:uaRL8wbPK5JLwR

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2824	2508	WerFault.exe	12

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2508	4c5f9acb693ce46e87fcb4b8e6be9310.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2824	2508	4c5f9acb693ce46e87fcb4b8e6be9310.exe	16
PID 2508 wrote to memory of 2824	2508	4c5f9acb693ce46e87fcb4b8e6be9310.exe	16
PID 2508 wrote to memory of 2824	2508	4c5f9acb693ce46e87fcb4b8e6be9310.exe	16
PID 2508 wrote to memory of 2824	2508	4c5f9acb693ce46e87fcb4b8e6be9310.exe	16

C:\Users\Admin\AppData\Local\Temp\4c5f9acb693ce46e87fcb4b8e6be9310.exe
"C:\Users\Admin\AppData\Local\Temp\4c5f9acb693ce46e87fcb4b8e6be9310.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 104
  2⤵
  - Program crash
  PID:2824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2508-1-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/2508-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2508-2-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download