Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
29/01/2024, 11:48
General
-
Target
RFQ-KYL-2024-E0002-B(02).exe
-
Size
191KB
-
MD5
0609cfc660c0dedb0e28217cf1fb7fbf
-
SHA1
1e75d9cda16c9b343baa9ee65c37cd84d5b56055
-
SHA256
55cd2f21de67fd054ed1f7337cb5483408ef085348cce685be7752615ca7667c
-
SHA512
c6fda97135e6c374a2f5f6337593772ce7a463c4a9423b7a269ab98b98588d885fa11331fefbaf8e2c6e6d9f3dd4e3f836045d3d1b59e0fd8bd9728262fc6f67
-
SSDEEP
3072:77QzuorbyWV0uXiJoLd64+Auk3dORlEMgK:YzuMWWVp3Z64+Auk3dORl4
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ-KYL-2024-E0002-B(02).exe"C:\Users\Admin\AppData\Local\Temp\RFQ-KYL-2024-E0002-B(02).exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 10842⤵
- Program crash
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
256KB