75f728fa692347e096386acd19a5da9b02dca372b66918be7171c522d9c6b42d

General

Target

75f728fa692347e096386acd19a5da9b02dca372b66918be7171c522d9c6b42d.exe
Size

600KB
MD5

363e2b62f93c58c177e58dbe0a247fa0
SHA1

e8abab85ccbaf646305aa5a786c0894d59bdcfd1
SHA256

75f728fa692347e096386acd19a5da9b02dca372b66918be7171c522d9c6b42d
SHA512

167734875f50d7e5cfa2ea8515b492d6ad18c5bc9ba881bbde520f0d0b79300af61c5bb42860fb613348933415d0518933d41e50ae837a8d5796d50b533932a3
SSDEEP

12288:hG5zC9ttHHIE8GlfXsIY8yMCa5XfP1D4+AAg6O:YcBDlPS8yM3XSmgZ

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

AddInProcess32.exe

pid process

3004 AddInProcess32.exe

pid	process
3004	AddInProcess32.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

75f728fa692347e096386acd19a5da9b02dca372b66918be7171c522d9c6b42d.exe

description	pid	process	target process
PID 4032 set thread context of 3004	4032	75f728fa692347e096386acd19a5da9b02dca372b66918be7171c522d9c6b42d.exe	AddInProcess32.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1276 3004 WerFault.exe AddInProcess32.exe

pid	pid_target	process	target process
1276	3004	WerFault.exe	AddInProcess32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

75f728fa692347e096386acd19a5da9b02dca372b66918be7171c522d9c6b42d.exe

pid	process
4032	75f728fa692347e096386acd19a5da9b02dca372b66918be7171c522d9c6b42d.exe
4032	75f728fa692347e096386acd19a5da9b02dca372b66918be7171c522d9c6b42d.exe
4032	75f728fa692347e096386acd19a5da9b02dca372b66918be7171c522d9c6b42d.exe
4032	75f728fa692347e096386acd19a5da9b02dca372b66918be7171c522d9c6b42d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

75f728fa692347e096386acd19a5da9b02dca372b66918be7171c522d9c6b42d.exe

description pid process

Token: SeDebugPrivilege 4032 75f728fa692347e096386acd19a5da9b02dca372b66918be7171c522d9c6b42d.exe

description	pid	process
Token: SeDebugPrivilege	4032	75f728fa692347e096386acd19a5da9b02dca372b66918be7171c522d9c6b42d.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

75f728fa692347e096386acd19a5da9b02dca372b66918be7171c522d9c6b42d.exe

description	pid	process	target process
PID 4032 wrote to memory of 3004	4032	75f728fa692347e096386acd19a5da9b02dca372b66918be7171c522d9c6b42d.exe	AddInProcess32.exe
PID 4032 wrote to memory of 3004	4032	75f728fa692347e096386acd19a5da9b02dca372b66918be7171c522d9c6b42d.exe	AddInProcess32.exe
PID 4032 wrote to memory of 3004	4032	75f728fa692347e096386acd19a5da9b02dca372b66918be7171c522d9c6b42d.exe	AddInProcess32.exe
PID 4032 wrote to memory of 3004	4032	75f728fa692347e096386acd19a5da9b02dca372b66918be7171c522d9c6b42d.exe	AddInProcess32.exe
PID 4032 wrote to memory of 3004	4032	75f728fa692347e096386acd19a5da9b02dca372b66918be7171c522d9c6b42d.exe	AddInProcess32.exe
PID 4032 wrote to memory of 3004	4032	75f728fa692347e096386acd19a5da9b02dca372b66918be7171c522d9c6b42d.exe	AddInProcess32.exe
PID 4032 wrote to memory of 3004	4032	75f728fa692347e096386acd19a5da9b02dca372b66918be7171c522d9c6b42d.exe	AddInProcess32.exe
PID 4032 wrote to memory of 3004	4032	75f728fa692347e096386acd19a5da9b02dca372b66918be7171c522d9c6b42d.exe	AddInProcess32.exe
PID 4032 wrote to memory of 3004	4032	75f728fa692347e096386acd19a5da9b02dca372b66918be7171c522d9c6b42d.exe	AddInProcess32.exe
PID 4032 wrote to memory of 3004	4032	75f728fa692347e096386acd19a5da9b02dca372b66918be7171c522d9c6b42d.exe	AddInProcess32.exe

C:\Users\Admin\AppData\Local\Temp\75f728fa692347e096386acd19a5da9b02dca372b66918be7171c522d9c6b42d.exe
"C:\Users\Admin\AppData\Local\Temp\75f728fa692347e096386acd19a5da9b02dca372b66918be7171c522d9c6b42d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
  "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"
  2⤵
  - Executes dropped EXE
  PID:3004
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 184
    3⤵
    - Program crash
    PID:1276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3004 -ip 3004
1⤵
PID:1220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe

Filesize
42KB

MD5
9827ff3cdf4b83f9c86354606736ca9c

SHA1
e73d73f42bb2a310f03eb1bcbb22be2b8eb7c723

SHA256
c1cf3dc8fa1c7fc00f88e07ad539979b3706ca8d69223cffd1d58bc8f521f63a

SHA512
8261828d55f3b5134c0aeb98311c04e20c5395d4347251746f3be0fb854f36cc7e118713cd00c9867537e6e47d5e71f2b2384fc00c67f0ae1b285b8310321579

Download Submit
memory/3004-27-0x0000000000170000-0x000000000017B000-memory.dmp

Filesize
44KB

Download
memory/3004-21-0x0000000000170000-0x000000000017B000-memory.dmp

Filesize
44KB

Download
memory/4032-11-0x00000000059E0000-0x00000000059F0000-memory.dmp

Filesize
64KB

Download
memory/4032-13-0x00000000059E0000-0x00000000059F0000-memory.dmp

Filesize
64KB

Download
memory/4032-5-0x0000000005EA0000-0x0000000005F3C000-memory.dmp

Filesize
624KB

Download
memory/4032-6-0x00000000059E0000-0x00000000059F0000-memory.dmp

Filesize
64KB

Download
memory/4032-7-0x0000000005A50000-0x0000000005A82000-memory.dmp

Filesize
200KB

Download
memory/4032-8-0x0000000005F80000-0x0000000005F96000-memory.dmp

Filesize
88KB

Download
memory/4032-9-0x000000000C260000-0x000000000C26A000-memory.dmp

Filesize
40KB

Download
memory/4032-0-0x0000000000F90000-0x0000000001026000-memory.dmp

Filesize
600KB

Download
memory/4032-12-0x0000000074F70000-0x0000000075720000-memory.dmp

Filesize
7.7MB

Download
memory/4032-4-0x0000000005B40000-0x0000000005E94000-memory.dmp

Filesize
3.3MB

Download
memory/4032-14-0x00000000059E0000-0x00000000059F0000-memory.dmp

Filesize
64KB

Download
memory/4032-15-0x0000000003310000-0x000000000332A000-memory.dmp

Filesize
104KB

Download
memory/4032-16-0x000000000D1A0000-0x000000000D1A6000-memory.dmp

Filesize
24KB

Download
memory/4032-17-0x0000000007A60000-0x0000000007A82000-memory.dmp

Filesize
136KB

Download
memory/4032-3-0x0000000005AA0000-0x0000000005B32000-memory.dmp

Filesize
584KB

Download
memory/4032-2-0x0000000005FB0000-0x0000000006554000-memory.dmp

Filesize
5.6MB

Download
memory/4032-25-0x0000000074F70000-0x0000000075720000-memory.dmp

Filesize
7.7MB

Download
memory/4032-1-0x0000000074F70000-0x0000000075720000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads