5bd14307f344f802ba2a43f18b118cd15fd2056c2e01dfeaa7b16afbe637e280

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/04/2024, 18:10

Target

DwmLutGUI.exe
Size

41KB
MD5

3b4757e1a391ad8afe84a433ea044335
SHA1

1d04873b685e26377ed7be16f1dea43f149dd07e
SHA256

5bd14307f344f802ba2a43f18b118cd15fd2056c2e01dfeaa7b16afbe637e280
SHA512

a4f95040ebb2839b6f87dacd687e22110e6f02c5a7032f4d9645c20b4bfe58cd8fb39eec9e1c59f4cb7fb6e6a23aa89e06d16713fa5fed337f0b192353574a3a
SSDEEP

768:Xu3QbzTyrqZmr3dYzBA9dMFciV5yQIXXFABQJVDDDDDRVDDDDDsetYcFwVc6K:XaQXurqZmr3dEKjit5yQIXVABQ0iwVcl

Score

1^/10

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1072	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1688	DwmLutGUI.exe
Token: SeDebugPrivilege	1688	DwmLutGUI.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2864	1688	DwmLutGUI.exe	28
PID 1688 wrote to memory of 2864	1688	DwmLutGUI.exe	28
PID 1688 wrote to memory of 2864	1688	DwmLutGUI.exe	28
PID 884 wrote to memory of 1072	884	cmd.exe	35
PID 884 wrote to memory of 1072	884	cmd.exe	35
PID 884 wrote to memory of 1072	884	cmd.exe	35

C:\Users\Admin\AppData\Local\Temp\DwmLutGUI.exe
"C:\Users\Admin\AppData\Local\Temp\DwmLutGUI.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1688 -s 644
  2⤵
  PID:2864

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:884
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1
  2⤵
  - Runs ping.exe
  PID:1072

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1688-0-0x000000013FA00000-0x000000013FA0E000-memory.dmp

Filesize
56KB

Download
memory/1688-1-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp

Filesize
9.9MB

Download
memory/1688-2-0x000000001BFC0000-0x000000001C040000-memory.dmp

Filesize
512KB

Download
memory/1688-3-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp

Filesize
9.9MB

Download