Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
25-04-2024 16:37
General
-
Target
a2b803974fcfb65e21fa1a7690eb2a4822f091a8bdf45786e2085c833871d5a0.exe
-
Size
987KB
-
MD5
a6455a248e43686bfda50622f2bd82d2
-
SHA1
de8544085d7969af9c9eda6cc418f26f9b144786
-
SHA256
a2b803974fcfb65e21fa1a7690eb2a4822f091a8bdf45786e2085c833871d5a0
-
SHA512
2820d87ffb9b1088dd61da458e4891d8247a3185099fe195e8fb5d2f8a135607eaf013b43718e347c30f0095bfe581a9e6d0b160ccba86d35dec168ea638aa2e
-
SSDEEP
12288:00QxgjNKY/6sBjn+lkNp6MARWch8k6SFkJkgskKA0kZPiDsRyNX5UrLB/ccOTOKw:00Qxgj8Y3n+lQkg6kZPiARysLBOTO+FG
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2b803974fcfb65e21fa1a7690eb2a4822f091a8bdf45786e2085c833871d5a0.exe"C:\Users\Admin\AppData\Local\Temp\a2b803974fcfb65e21fa1a7690eb2a4822f091a8bdf45786e2085c833871d5a0.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1952 -s 5402⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1952-0-0x0000000001070000-0x00000000010D8000-memory.dmpFilesize
416KB
-
memory/1952-1-0x000007FEF5840000-0x000007FEF622C000-memory.dmpFilesize
9.9MB
-
memory/1952-2-0x00000000006B0000-0x0000000000730000-memory.dmpFilesize
512KB
-
memory/1952-3-0x000007FEF5840000-0x000007FEF622C000-memory.dmpFilesize
9.9MB
-
memory/1952-4-0x00000000006B0000-0x0000000000730000-memory.dmpFilesize
512KB