a7ce97708d6a93b4121c20a8caf3aa973dda0399179d6a215bbdfd816fb8606a | Triage

Resubmissions

07/07/2024, 21:04

240707-zwtcqazhrd 4

07/07/2024, 21:03

240707-zwbgxazhqg 3

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
07/07/2024, 21:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

OverwolfInsiderPatcher.exe
Size

577KB
MD5

de98fac959df70c20982417ea2bbe57b
SHA1

a35423ed27b2eb2086e1491a0085248b68c27914
SHA256

a7ce97708d6a93b4121c20a8caf3aa973dda0399179d6a215bbdfd816fb8606a
SHA512

82ac530ad95c807374b580d080b94a2b5cbb2e889fe28496c580a1cc167ce23a0bda675bc3e034e492305217ecb704dda086f44b65cdf89ea316d46400515dd5
SSDEEP

6144:GVOgrU9FaYwF2V5JlCsKw68nOBtTU2Rz6iTDYESNt5F9DMjHyx:GVOwU9FP5RNnQt9DY3t5w

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
756	4968	WerFault.exe	80

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4968	OverwolfInsiderPatcher.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4968	OverwolfInsiderPatcher.exe

C:\Users\Admin\AppData\Local\Temp\OverwolfInsiderPatcher.exe
"C:\Users\Admin\AppData\Local\Temp\OverwolfInsiderPatcher.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 824
  2⤵
  - Program crash
  PID:756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4968 -ip 4968
1⤵
PID:624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4968-0-0x00000000744AE000-0x00000000744AF000-memory.dmp

Filesize
4KB

Download
memory/4968-1-0x0000000000DC0000-0x0000000000E56000-memory.dmp

Filesize
600KB

Download