fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e

General

Target

fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe
Size

365KB
MD5

2371d432700a7e1f9c070a6e97fdb634
SHA1

00d6c66ab2fd1810628d13980cc73275884933b1
SHA256

fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e
SHA512

423e76393e65defab5cdaef0c2a3249cadfbd3413d6763db8428e3a6a13e2a880c6a93cba35cf783ccc126b26bcd3e6ad6bf3059be94ca0d3798b75b51c4e7e5
SSDEEP

6144:tYGb1U2Ptkfh6jyA2leZT2r5ldd1HaAcurTIL+e2AwlFa6oFNWGc/4m6I1rr:tYGb1U2Ptkfh6jyATE5N1HHcuYKZAwlt

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2336 set thread context of 2664	2336	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2940	2664	WerFault.exe	29

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2336	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe
2336	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe
2336	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe
2336	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2336	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2664	2336	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	29
PID 2336 wrote to memory of 2664	2336	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	29
PID 2336 wrote to memory of 2664	2336	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	29
PID 2336 wrote to memory of 2664	2336	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	29
PID 2336 wrote to memory of 2664	2336	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	29
PID 2336 wrote to memory of 2664	2336	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	29
PID 2336 wrote to memory of 2664	2336	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	29
PID 2336 wrote to memory of 2664	2336	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	29
PID 2336 wrote to memory of 2664	2336	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	29
PID 2336 wrote to memory of 2664	2336	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	29
PID 2336 wrote to memory of 2664	2336	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	29
PID 2336 wrote to memory of 2664	2336	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	29
PID 2336 wrote to memory of 2664	2336	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	29
PID 2336 wrote to memory of 2664	2336	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	29
PID 2664 wrote to memory of 2940	2664	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	30
PID 2664 wrote to memory of 2940	2664	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	30
PID 2664 wrote to memory of 2940	2664	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	30
PID 2664 wrote to memory of 2940	2664	fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe	30

C:\Users\Admin\AppData\Local\Temp\fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe
"C:\Users\Admin\AppData\Local\Temp\fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Users\Admin\AppData\Local\Temp\fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe
  "C:\Users\Admin\AppData\Local\Temp\fa1bc7d6f03a49af50f7153814a078a32f24f353c9cb2b8e3f329888f2b37a6e.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 36
    3⤵
    - Program crash
    PID:2940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2336-8-0x0000000000520000-0x0000000000526000-memory.dmp

Filesize
24KB

Download
memory/2336-20-0x0000000074320000-0x0000000074A0E000-memory.dmp

Filesize
6.9MB

Download
memory/2336-1-0x0000000074320000-0x0000000074A0E000-memory.dmp

Filesize
6.9MB

Download
memory/2336-3-0x0000000000370000-0x00000000003A2000-memory.dmp

Filesize
200KB

Download
memory/2336-4-0x00000000003A0000-0x00000000003B6000-memory.dmp

Filesize
88KB

Download
memory/2336-5-0x0000000074320000-0x0000000074A0E000-memory.dmp

Filesize
6.9MB

Download
memory/2336-6-0x0000000000220000-0x0000000000260000-memory.dmp

Filesize
256KB

Download
memory/2336-7-0x0000000002050000-0x000000000206A000-memory.dmp

Filesize
104KB

Download
memory/2336-2-0x0000000000220000-0x0000000000260000-memory.dmp

Filesize
256KB

Download
memory/2336-0-0x0000000000840000-0x00000000008A0000-memory.dmp

Filesize
384KB

Download
memory/2336-9-0x0000000000220000-0x0000000000260000-memory.dmp

Filesize
256KB

Download
memory/2664-10-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2664-12-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2664-14-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2664-15-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2664-16-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2664-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2664-19-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2664-13-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing