Analysis

  • max time kernel
    119s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    02/06/2024, 01:08

General

  • Target

    eede1bbc45fe5db34381b52131d9a982c2bed308084fe7382b3505a3b0604f26.exe

  • Size

    3.7MB

  • MD5

    4a32d4acf9add6285c481656dbc63fd7

  • SHA1

    7802410a0a366c0e0c3d25a207b02239c85824f7

  • SHA256

    eede1bbc45fe5db34381b52131d9a982c2bed308084fe7382b3505a3b0604f26

  • SHA512

    09721574314f47f2dfa0a74194ce7e3d8b1ecc61259287b36ee08fec8598863e79cca85917897983d6515fe990838eb4862e98c980b6e77f417cdc38375da0fd

  • SSDEEP

    49152:v/IrHmeNydk5p5Fq1gWosbPOUh5tUmEcm:v/IrHNNydk5p5Fq1gWo6FhzUmK

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eede1bbc45fe5db34381b52131d9a982c2bed308084fe7382b3505a3b0604f26.exe
    "C:\Users\Admin\AppData\Local\Temp\eede1bbc45fe5db34381b52131d9a982c2bed308084fe7382b3505a3b0604f26.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1692
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1692 -s 700
      2⤵
        PID:2616

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1692-0-0x000007FEF5743000-0x000007FEF5744000-memory.dmp

            Filesize

            4KB

          • memory/1692-1-0x0000000000B30000-0x0000000000EDC000-memory.dmp

            Filesize

            3.7MB

          • memory/1692-2-0x000007FEF5740000-0x000007FEF612C000-memory.dmp

            Filesize

            9.9MB

          • memory/1692-3-0x000007FEF5740000-0x000007FEF612C000-memory.dmp

            Filesize

            9.9MB

          • memory/1692-4-0x000007FEF5740000-0x000007FEF612C000-memory.dmp

            Filesize

            9.9MB

          • memory/1692-5-0x000007FEF5743000-0x000007FEF5744000-memory.dmp

            Filesize

            4KB

          • memory/1692-6-0x000007FEF5740000-0x000007FEF612C000-memory.dmp

            Filesize

            9.9MB