Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/03/2024, 17:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dfb43dfbc0bf18d8d5a72aaea86d3ea4.exe
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
dfb43dfbc0bf18d8d5a72aaea86d3ea4.exe
Resource
win10v2004-20240226-en
1 signatures
150 seconds
General
-
Target
dfb43dfbc0bf18d8d5a72aaea86d3ea4.exe
-
Size
9KB
-
MD5
dfb43dfbc0bf18d8d5a72aaea86d3ea4
-
SHA1
0e4285b448acd02d4e4a4f9326083bbddca7d80e
-
SHA256
249da61c7608dcc3eb85eeeac464d4f80e2f199fd6568f3bcdc5c1f0ae8d2286
-
SHA512
6e9c65edb19c43f02cc9b10cdd4b3254624f8382d9e872805d5c12a64a3450e8c14ffd003d1f6088a7ca19cabde215e8863c7c2dce89b5bdf3d8293b417e94b9
-
SSDEEP
192:SBksuz9MuI5GeMZZ3093Vnjdwqzh3MlYnWv:bl4GeM4Fnhwq98qW
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2956 dfb43dfbc0bf18d8d5a72aaea86d3ea4.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2956 wrote to memory of 2868 2956 dfb43dfbc0bf18d8d5a72aaea86d3ea4.exe 30 PID 2956 wrote to memory of 2868 2956 dfb43dfbc0bf18d8d5a72aaea86d3ea4.exe 30 PID 2956 wrote to memory of 2868 2956 dfb43dfbc0bf18d8d5a72aaea86d3ea4.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfb43dfbc0bf18d8d5a72aaea86d3ea4.exe"C:\Users\Admin\AppData\Local\Temp\dfb43dfbc0bf18d8d5a72aaea86d3ea4.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2956 -s 9042⤵PID:2868
-