Analysis
-
max time kernel
117s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
26-02-2024 18:30
General
-
Target
FSE2.exe
-
Size
50KB
-
MD5
3edc1fc459ea2dc098722261ec3fbe05
-
SHA1
8fbb8efa0a3ba27d29a184a4b182ff537f82c9a8
-
SHA256
89f3cdd4c1e20eeac4d39fa709d40e8f3ebd8985a0a76673a44cf117eeeb458b
-
SHA512
a6cf1c104f8dece689cd21f7d65d510f07e86d25600f42d61838a664fbf640ead66fe4523499a38f37951faa3028bd469ad8f483287f986218f8cbfb50f3256d
-
SSDEEP
768:PhiPG/q1nVY2kh5yGJMwCH8Ufrg04g0rTpEIkGAwd:pzonVXkhVJMwCH5frgiMd
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\FSE2.exe"C:\Users\Admin\AppData\Local\Temp\FSE2.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 16762⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2020-1-0x00000000745C0000-0x0000000074CAE000-memory.dmpFilesize
6.9MB
-
memory/2020-0-0x0000000000FB0000-0x0000000000FC2000-memory.dmpFilesize
72KB
-
memory/2020-2-0x0000000004B80000-0x0000000004CF6000-memory.dmpFilesize
1.5MB
-
memory/2020-3-0x0000000000250000-0x000000000025C000-memory.dmpFilesize
48KB
-
memory/2020-4-0x0000000000450000-0x0000000000460000-memory.dmpFilesize
64KB
-
memory/2020-5-0x00000000049C0000-0x0000000004A00000-memory.dmpFilesize
256KB
-
memory/2020-6-0x00000000745C0000-0x0000000074CAE000-memory.dmpFilesize
6.9MB
-
memory/2020-7-0x00000000049C0000-0x0000000004A00000-memory.dmpFilesize
256KB