6c481a8149442be4fdae9158e9275ef3c3c918040b387ce5248050f88da87676

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-09-2024 01:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c481a8149442be4fdae9158e9275ef3c3c918040b387ce5248050f88da87676.exe
Size

497KB
MD5

60fdae7957c24a52dcb84aa1802edbd4
SHA1

4f38d0c6f43e8d6efaa6d4355d563213b0cf6866
SHA256

6c481a8149442be4fdae9158e9275ef3c3c918040b387ce5248050f88da87676
SHA512

9367458d72ba32b3e0542c94afc0ea6f3cf5c5fcbb17f45cac917ea1f35225292de9185a8b5df60e6bb43047c4546c638489addc41db4f052094224b053057fc
SSDEEP

1536:CH8HxsM08Tcgc92csCGlTyzUuZ0SVPRiNaQnFYUHKa/GUkgGPYSLgVay+Zm1SMhf:PZGmtFfqgOYSLgf+ZmRvV5FPV

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
884	6c481a8149442be4fdae9158e9275ef3c3c918040b387ce5248050f88da87676.exe
884	6c481a8149442be4fdae9158e9275ef3c3c918040b387ce5248050f88da87676.exe
884	6c481a8149442be4fdae9158e9275ef3c3c918040b387ce5248050f88da87676.exe
884	6c481a8149442be4fdae9158e9275ef3c3c918040b387ce5248050f88da87676.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	884	6c481a8149442be4fdae9158e9275ef3c3c918040b387ce5248050f88da87676.exe
Token: SeDebugPrivilege	884	6c481a8149442be4fdae9158e9275ef3c3c918040b387ce5248050f88da87676.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 6080	884	6c481a8149442be4fdae9158e9275ef3c3c918040b387ce5248050f88da87676.exe	31
PID 884 wrote to memory of 6080	884	6c481a8149442be4fdae9158e9275ef3c3c918040b387ce5248050f88da87676.exe	31
PID 884 wrote to memory of 6080	884	6c481a8149442be4fdae9158e9275ef3c3c918040b387ce5248050f88da87676.exe	31

C:\Users\Admin\AppData\Local\Temp\6c481a8149442be4fdae9158e9275ef3c3c918040b387ce5248050f88da87676.exe
"C:\Users\Admin\AppData\Local\Temp\6c481a8149442be4fdae9158e9275ef3c3c918040b387ce5248050f88da87676.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:884
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 884 -s 1624
  2⤵
  PID:6080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/884-0-0x000007FEF4E23000-0x000007FEF4E24000-memory.dmp

Filesize
4KB

Download
memory/884-1-0x00000000003C0000-0x0000000000440000-memory.dmp

Filesize
512KB

Download
memory/884-2-0x000007FEF4E20000-0x000007FEF580C000-memory.dmp

Filesize
9.9MB

Download
memory/884-3-0x000000001BF20000-0x000000001C020000-memory.dmp

Filesize
1024KB

Download
memory/884-7-0x000000001BF20000-0x000000001C01B000-memory.dmp

Filesize
1004KB

Download
memory/884-4-0x000000001BF20000-0x000000001C01B000-memory.dmp

Filesize
1004KB

Download
memory/884-5-0x000000001BF20000-0x000000001C01B000-memory.dmp

Filesize
1004KB

Download
memory/884-9-0x000000001BF20000-0x000000001C01B000-memory.dmp

Filesize
1004KB

Download
memory/884-11-0x000000001BF20000-0x000000001C01B000-memory.dmp

Filesize
1004KB

Download
memory/884-15-0x000000001BF20000-0x000000001C01B000-memory.dmp

Filesize
1004KB

Download
memory/884-21-0x000000001BF20000-0x000000001C01B000-memory.dmp

Filesize
1004KB

Download
memory/884-29-0x000000001BF20000-0x000000001C01B000-memory.dmp

Filesize
1004KB

Download
memory/884-33-0x000000001BF20000-0x000000001C01B000-memory.dmp

Filesize
1004KB

Download
memory/884-32-0x000000001BF20000-0x000000001C01B000-memory.dmp

Filesize
1004KB

Download
memory/884-27-0x000000001BF20000-0x000000001C01B000-memory.dmp

Filesize
1004KB

Download
memory/884-35-0x000000001BF20000-0x000000001C01B000-memory.dmp

Filesize
1004KB

Download
memory/884-25-0x000000001BF20000-0x000000001C01B000-memory.dmp

Filesize
1004KB

Download
memory/884-23-0x000000001BF20000-0x000000001C01B000-memory.dmp

Filesize
1004KB

Download
memory/884-19-0x000000001BF20000-0x000000001C01B000-memory.dmp

Filesize
1004KB

Download
memory/884-37-0x000000001BF20000-0x000000001C01B000-memory.dmp

Filesize
1004KB

Download
memory/884-17-0x000000001BF20000-0x000000001C01B000-memory.dmp

Filesize
1004KB

Download
memory/884-13-0x000000001BF20000-0x000000001C01B000-memory.dmp

Filesize
1004KB

Download
memory/884-39-0x000000001BF20000-0x000000001C01B000-memory.dmp

Filesize
1004KB

Download
memory/884-45-0x000000001BF20000-0x000000001C01B000-memory.dmp

Filesize
1004KB

Download
memory/884-47-0x000000001BF20000-0x000000001C01B000-memory.dmp

Filesize
1004KB

Download
memory/884-51-0x000000001BF20000-0x000000001C01B000-memory.dmp

Filesize
1004KB

Download
memory/884-55-0x000000001BF20000-0x000000001C01B000-memory.dmp

Filesize
1004KB

Download
memory/884-53-0x000000001BF20000-0x000000001C01B000-memory.dmp

Filesize
1004KB

Download
memory/884-49-0x000000001BF20000-0x000000001C01B000-memory.dmp

Filesize
1004KB

Download
memory/884-43-0x000000001BF20000-0x000000001C01B000-memory.dmp

Filesize
1004KB

Download
memory/884-41-0x000000001BF20000-0x000000001C01B000-memory.dmp

Filesize
1004KB

Download
memory/884-61-0x000000001BF20000-0x000000001C01B000-memory.dmp

Filesize
1004KB

Download
memory/884-63-0x000000001BF20000-0x000000001C01B000-memory.dmp

Filesize
1004KB

Download
memory/884-67-0x000000001BF20000-0x000000001C01B000-memory.dmp

Filesize
1004KB

Download
memory/884-65-0x000000001BF20000-0x000000001C01B000-memory.dmp

Filesize
1004KB

Download
memory/884-59-0x000000001BF20000-0x000000001C01B000-memory.dmp

Filesize
1004KB

Download
memory/884-57-0x000000001BF20000-0x000000001C01B000-memory.dmp

Filesize
1004KB

Download
memory/884-1079-0x000007FEF4E20000-0x000007FEF580C000-memory.dmp

Filesize
9.9MB

Download
memory/884-1078-0x000007FEF4E23000-0x000007FEF4E24000-memory.dmp

Filesize
4KB

Download
memory/884-1080-0x000007FEF4E20000-0x000007FEF580C000-memory.dmp

Filesize
9.9MB

Download
memory/884-1081-0x00000000023A0000-0x000000000241C000-memory.dmp

Filesize
496KB

Download
memory/884-1082-0x0000000000AB0000-0x0000000000AFC000-memory.dmp

Filesize
304KB

Download
memory/884-1083-0x000007FEF4E20000-0x000007FEF580C000-memory.dmp

Filesize
9.9MB

Download
memory/884-1084-0x000000001AE10000-0x000000001AE64000-memory.dmp

Filesize
336KB

Download