208a0ccd43310a08a05bae97cbdad0c1659028f1e3369cba85470ce12bb8731d | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-01-2024 00:47

Sharing

Report Analysis Logs

General

Target

7e70506b4c5d4c99b914c0cc53aa72d4.exe
Size

28KB
MD5

7e70506b4c5d4c99b914c0cc53aa72d4
SHA1

8cac0d54c2da4c93d63f3d53f01935486488badb
SHA256

208a0ccd43310a08a05bae97cbdad0c1659028f1e3369cba85470ce12bb8731d
SHA512

2be2b3aef734283ac4533fa9301a8382bbf954a668c50a179a5bf8db7cfe5080dba107a22e839df31700d47326a82d15ed85e9e5276a1ac4f426b19dcdbb0eb0
SSDEEP

384:bDQ8niTI2g4ez7EIiwYdGcdx+Nxcj4GSPIoI1:bDQ8nYIP4VQmGcdx+CjCPI

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2124	2312	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2312	7e70506b4c5d4c99b914c0cc53aa72d4.exe
Token: SeSystemtimePrivilege	2312	7e70506b4c5d4c99b914c0cc53aa72d4.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2124	2312	7e70506b4c5d4c99b914c0cc53aa72d4.exe	28
PID 2312 wrote to memory of 2124	2312	7e70506b4c5d4c99b914c0cc53aa72d4.exe	28
PID 2312 wrote to memory of 2124	2312	7e70506b4c5d4c99b914c0cc53aa72d4.exe	28
PID 2312 wrote to memory of 2124	2312	7e70506b4c5d4c99b914c0cc53aa72d4.exe	28

C:\Users\Admin\AppData\Local\Temp\7e70506b4c5d4c99b914c0cc53aa72d4.exe
"C:\Users\Admin\AppData\Local\Temp\7e70506b4c5d4c99b914c0cc53aa72d4.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 168
  2⤵
  - Program crash
  PID:2124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads