f4055022c94103087ce5fe4ee8493bc11e6fb9c788134fc732aa9ff5d05cb765

Analysis

max time kernel
119s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/04/2024, 04:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

PG3DInjector.exe
Size

76.1MB
MD5

666d27360a5154c9797e3644f22a4a67
SHA1

31b8aa2ef6eb33dbbb2fd1305114c806b854be35
SHA256

f4055022c94103087ce5fe4ee8493bc11e6fb9c788134fc732aa9ff5d05cb765
SHA512

042e32431b62d45a09b13f94f0699ec1d94b60c88705ca23ccbea9e939010bb99f98df437672694aa19e47a26aeb8f865a60053475b18d833ec6015b263dedbd
SSDEEP

393216:lQeufzJiVWHIFrrmsx5lv8QshCe9dlkEBO2/w0XzN2FX7RIMnBZ1IQ0P543WbtZV:l5utHUrrm2DEQshjlYPDA5UUVIa2Q

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2152	PG3DInjector.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2152	PG3DInjector.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2608	2152	PG3DInjector.exe	29
PID 2152 wrote to memory of 2608	2152	PG3DInjector.exe	29
PID 2152 wrote to memory of 2608	2152	PG3DInjector.exe	29

C:\Users\Admin\AppData\Local\Temp\PG3DInjector.exe
"C:\Users\Admin\AppData\Local\Temp\PG3DInjector.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2152 -s 596
  2⤵
  PID:2608

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2152-0-0x0000000002CC0000-0x0000000003150000-memory.dmp

Filesize
4.6MB

Download
memory/2152-3-0x000000013F1E0000-0x000000013FB50000-memory.dmp

Filesize
9.4MB

Download
memory/2152-5-0x0000000005D00000-0x00000000088A0000-memory.dmp

Filesize
43.6MB

Download
memory/2152-10-0x0000000000420000-0x0000000000460000-memory.dmp

Filesize
256KB

Download
memory/2152-14-0x0000000000460000-0x0000000000470000-memory.dmp

Filesize
64KB

Download
memory/2152-18-0x0000000001CE0000-0x0000000001D00000-memory.dmp

Filesize
128KB

Download
memory/2152-22-0x00000000021F0000-0x00000000022A0000-memory.dmp

Filesize
704KB

Download
memory/2152-26-0x0000000001EB0000-0x0000000001ED0000-memory.dmp

Filesize
128KB

Download
memory/2152-30-0x00000000004B0000-0x00000000004C0000-memory.dmp

Filesize
64KB

Download
memory/2152-34-0x0000000002140000-0x0000000002170000-memory.dmp

Filesize
192KB

Download
memory/2152-38-0x0000000003550000-0x00000000035A0000-memory.dmp

Filesize
320KB

Download
memory/2152-42-0x00000000037F0000-0x00000000038B0000-memory.dmp

Filesize
768KB

Download
memory/2152-46-0x00000000038B0000-0x00000000038D0000-memory.dmp

Filesize
128KB

Download
memory/2152-50-0x0000000003900000-0x0000000003930000-memory.dmp

Filesize
192KB

Download
memory/2152-54-0x0000000003960000-0x0000000003990000-memory.dmp

Filesize
192KB

Download
memory/2152-58-0x0000000001F00000-0x0000000001F10000-memory.dmp

Filesize
64KB

Download
memory/2152-62-0x0000000003660000-0x0000000003670000-memory.dmp

Filesize
64KB

Download
memory/2152-82-0x000000013F1E0000-0x000000013FB50000-memory.dmp

Filesize
9.4MB

Download