fe6ecf828b9d543d51da9321931b397b6b759eaf2cdd78c1e2a310220f5304cc | Triage

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 12:13

Sharing

Report Analysis Logs

General

Target

8c4b70d2f703106f27ed130828228562.exe
Size

9KB
MD5

8c4b70d2f703106f27ed130828228562
SHA1

01e505dc8b5ca7e8081d6b1c20896fb8ce865bba
SHA256

fe6ecf828b9d543d51da9321931b397b6b759eaf2cdd78c1e2a310220f5304cc
SHA512

c08d6d6807bd36dd641d2dba0f866585b2d3c9727dee522379db52dd0320ffe621f39a3c9701802b73e09036431f4d2cb18acfb8d90c1bcb3d2e365cb63474a0
SSDEEP

192:jBksuHDUSOV2orXeMZZ3A93VnjdwCzS3hwmi:WMXeMMFnhwCORwm

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2332	8c4b70d2f703106f27ed130828228562.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2888	2332	8c4b70d2f703106f27ed130828228562.exe	28
PID 2332 wrote to memory of 2888	2332	8c4b70d2f703106f27ed130828228562.exe	28
PID 2332 wrote to memory of 2888	2332	8c4b70d2f703106f27ed130828228562.exe	28

C:\Users\Admin\AppData\Local\Temp\8c4b70d2f703106f27ed130828228562.exe
"C:\Users\Admin\AppData\Local\Temp\8c4b70d2f703106f27ed130828228562.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2332 -s 896
  2⤵
  PID:2888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2332-0-0x0000000001030000-0x0000000001038000-memory.dmp

Filesize
32KB

Download
memory/2332-1-0x000007FEF5C30000-0x000007FEF661C000-memory.dmp

Filesize
9.9MB

Download
memory/2332-2-0x0000000000F70000-0x0000000000FF0000-memory.dmp

Filesize
512KB

Download
memory/2332-3-0x000007FEF5C30000-0x000007FEF661C000-memory.dmp

Filesize
9.9MB

Download