d1766bdd7fb4b66d2a56f66a31b51b16151ddc3c5839d05b185747afa6f9e7f7 | Triage

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 22:44

Sharing

Report Analysis Logs

General

Target

drxco11.exe
Size

11KB
MD5

0e968ab6ebe8521d29b4175618b16500
SHA1

f633a068991aa227db384096452cc996f187f951
SHA256

d1766bdd7fb4b66d2a56f66a31b51b16151ddc3c5839d05b185747afa6f9e7f7
SHA512

887a1b1bda2d2eb38ba805f3e228214ecb4d81f1cf2d0f892c0ce59c99104a20dc55a980da2fe57cf7e5616afc0ea10a3931f7f5bf920d623748314e1cb92361
SSDEEP

192:1VNftcJxEU9kXUArj59qzIIW1PnalsYcXR/0V5cWVZq:bN+4EAR9q+nalsZXR/0VpVZ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2524	2516	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2516	drxco11.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2524	2516	drxco11.exe	29
PID 2516 wrote to memory of 2524	2516	drxco11.exe	29
PID 2516 wrote to memory of 2524	2516	drxco11.exe	29
PID 2516 wrote to memory of 2524	2516	drxco11.exe	29

C:\Users\Admin\AppData\Local\Temp\drxco11.exe
"C:\Users\Admin\AppData\Local\Temp\drxco11.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 1228
  2⤵
  - Program crash
  PID:2524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2516-0-0x0000000000BA0000-0x0000000000BAA000-memory.dmp

Filesize
40KB

Download
memory/2516-1-0x0000000074470000-0x0000000074B5E000-memory.dmp

Filesize
6.9MB

Download
memory/2516-2-0x00000000008A0000-0x00000000008E0000-memory.dmp

Filesize
256KB

Download
memory/2516-3-0x0000000074470000-0x0000000074B5E000-memory.dmp

Filesize
6.9MB

Download