f729c77c10c83d41d52dabe964cb28c90b916a694bb56477edd05ff384d0e16e

General

Target

f729c77c10c83d41d52dabe964cb28c90b916a694bb56477edd05ff384d0e16e.exe
Size

681KB
MD5

0a571994bb0703417ea63bc30c0d7190
SHA1

78db87c271b29ce4e68162e9930eece89db7e538
SHA256

f729c77c10c83d41d52dabe964cb28c90b916a694bb56477edd05ff384d0e16e
SHA512

c924d7f57fa460f501840a4834b54ade1e3a3c26433c9c18701fc9ea8cfed1ead95da28390f15ffaa8c4597273140862018cc7f5272ec2c5b159ffe1159852ad
SSDEEP

12288:b5X3inVFaDCg3DSpHVQZtF1lIVZtugd1h4+HYgurUj6hHUFlxbi8mCmd7TxQOr:J32HZgMMLYa41h4+Tj6pUZbJtmd7GO

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1992 set thread context of 2668	1992	f729c77c10c83d41d52dabe964cb28c90b916a694bb56477edd05ff384d0e16e.exe	28

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2552	1992	WerFault.exe	27
2592	2668	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1992	f729c77c10c83d41d52dabe964cb28c90b916a694bb56477edd05ff384d0e16e.exe
1992	f729c77c10c83d41d52dabe964cb28c90b916a694bb56477edd05ff384d0e16e.exe
1992	f729c77c10c83d41d52dabe964cb28c90b916a694bb56477edd05ff384d0e16e.exe
1992	f729c77c10c83d41d52dabe964cb28c90b916a694bb56477edd05ff384d0e16e.exe
1992	f729c77c10c83d41d52dabe964cb28c90b916a694bb56477edd05ff384d0e16e.exe
1992	f729c77c10c83d41d52dabe964cb28c90b916a694bb56477edd05ff384d0e16e.exe
1992	f729c77c10c83d41d52dabe964cb28c90b916a694bb56477edd05ff384d0e16e.exe
2668	f729c77c10c83d41d52dabe964cb28c90b916a694bb56477edd05ff384d0e16e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1992	f729c77c10c83d41d52dabe964cb28c90b916a694bb56477edd05ff384d0e16e.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2668	1992	f729c77c10c83d41d52dabe964cb28c90b916a694bb56477edd05ff384d0e16e.exe	28
PID 1992 wrote to memory of 2668	1992	f729c77c10c83d41d52dabe964cb28c90b916a694bb56477edd05ff384d0e16e.exe	28
PID 1992 wrote to memory of 2668	1992	f729c77c10c83d41d52dabe964cb28c90b916a694bb56477edd05ff384d0e16e.exe	28
PID 1992 wrote to memory of 2668	1992	f729c77c10c83d41d52dabe964cb28c90b916a694bb56477edd05ff384d0e16e.exe	28
PID 1992 wrote to memory of 2668	1992	f729c77c10c83d41d52dabe964cb28c90b916a694bb56477edd05ff384d0e16e.exe	28
PID 1992 wrote to memory of 2668	1992	f729c77c10c83d41d52dabe964cb28c90b916a694bb56477edd05ff384d0e16e.exe	28
PID 1992 wrote to memory of 2668	1992	f729c77c10c83d41d52dabe964cb28c90b916a694bb56477edd05ff384d0e16e.exe	28
PID 1992 wrote to memory of 2552	1992	f729c77c10c83d41d52dabe964cb28c90b916a694bb56477edd05ff384d0e16e.exe	29
PID 1992 wrote to memory of 2552	1992	f729c77c10c83d41d52dabe964cb28c90b916a694bb56477edd05ff384d0e16e.exe	29
PID 1992 wrote to memory of 2552	1992	f729c77c10c83d41d52dabe964cb28c90b916a694bb56477edd05ff384d0e16e.exe	29
PID 1992 wrote to memory of 2552	1992	f729c77c10c83d41d52dabe964cb28c90b916a694bb56477edd05ff384d0e16e.exe	29
PID 2668 wrote to memory of 2592	2668	f729c77c10c83d41d52dabe964cb28c90b916a694bb56477edd05ff384d0e16e.exe	30
PID 2668 wrote to memory of 2592	2668	f729c77c10c83d41d52dabe964cb28c90b916a694bb56477edd05ff384d0e16e.exe	30
PID 2668 wrote to memory of 2592	2668	f729c77c10c83d41d52dabe964cb28c90b916a694bb56477edd05ff384d0e16e.exe	30
PID 2668 wrote to memory of 2592	2668	f729c77c10c83d41d52dabe964cb28c90b916a694bb56477edd05ff384d0e16e.exe	30

C:\Users\Admin\AppData\Local\Temp\f729c77c10c83d41d52dabe964cb28c90b916a694bb56477edd05ff384d0e16e.exe
"C:\Users\Admin\AppData\Local\Temp\f729c77c10c83d41d52dabe964cb28c90b916a694bb56477edd05ff384d0e16e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Users\Admin\AppData\Local\Temp\f729c77c10c83d41d52dabe964cb28c90b916a694bb56477edd05ff384d0e16e.exe
  "C:\Users\Admin\AppData\Local\Temp\f729c77c10c83d41d52dabe964cb28c90b916a694bb56477edd05ff384d0e16e.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 36
    3⤵
    - Program crash
    PID:2592
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 736
  2⤵
  - Program crash
  PID:2552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1992-14-0x00000000745A0000-0x0000000074C8E000-memory.dmp

Filesize
6.9MB

Download
memory/1992-0-0x0000000000E50000-0x0000000000F00000-memory.dmp

Filesize
704KB

Download
memory/1992-2-0x0000000004F80000-0x0000000004FC0000-memory.dmp

Filesize
256KB

Download
memory/1992-3-0x0000000000660000-0x000000000067C000-memory.dmp

Filesize
112KB

Download
memory/1992-4-0x0000000000430000-0x000000000043C000-memory.dmp

Filesize
48KB

Download
memory/1992-5-0x00000000009B0000-0x00000000009BE000-memory.dmp

Filesize
56KB

Download
memory/1992-6-0x0000000004DB0000-0x0000000004E36000-memory.dmp

Filesize
536KB

Download
memory/1992-16-0x0000000004F80000-0x0000000004FC0000-memory.dmp

Filesize
256KB

Download
memory/1992-1-0x00000000745A0000-0x0000000074C8E000-memory.dmp

Filesize
6.9MB

Download
memory/2668-9-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2668-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2668-13-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2668-15-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2668-7-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2668-17-0x0000000000A30000-0x0000000000D33000-memory.dmp

Filesize
3.0MB

Download
memory/2668-18-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing