5f3215ad04a8277ce78a17ea870beb4189e6fee16f36942c25d98ca24e9166e9

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
24-09-2024 01:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f3215ad04a8277ce78a17ea870beb4189e6fee16f36942c25d98ca24e9166e9.exe
Size

368KB
MD5

51f72822ddf3ea7523d116ff4328c22f
SHA1

70e22a50a272f9cecac73153e812fa9d140edd4d
SHA256

5f3215ad04a8277ce78a17ea870beb4189e6fee16f36942c25d98ca24e9166e9
SHA512

9bc35c63f3fbf48d362d7132925d27880333a13e2cdc2b0cbd9f1040475b410701aa1791504f92559622f44d99ab5cd3ece37ec7b8682685fc86e69b0937540b
SSDEEP

384:OJGY/HAGNn06CjFN8P3YsU6fCWYA8S/hs/E2sofOh/Q0RbnqRGt/KzVtBBU:OJVdNdM8sScR9ApqcAg

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2368	5f3215ad04a8277ce78a17ea870beb4189e6fee16f36942c25d98ca24e9166e9.exe
2368	5f3215ad04a8277ce78a17ea870beb4189e6fee16f36942c25d98ca24e9166e9.exe
2368	5f3215ad04a8277ce78a17ea870beb4189e6fee16f36942c25d98ca24e9166e9.exe
2368	5f3215ad04a8277ce78a17ea870beb4189e6fee16f36942c25d98ca24e9166e9.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2368	5f3215ad04a8277ce78a17ea870beb4189e6fee16f36942c25d98ca24e9166e9.exe
Token: SeDebugPrivilege	2368	5f3215ad04a8277ce78a17ea870beb4189e6fee16f36942c25d98ca24e9166e9.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 6040	2368	5f3215ad04a8277ce78a17ea870beb4189e6fee16f36942c25d98ca24e9166e9.exe	32
PID 2368 wrote to memory of 6040	2368	5f3215ad04a8277ce78a17ea870beb4189e6fee16f36942c25d98ca24e9166e9.exe	32
PID 2368 wrote to memory of 6040	2368	5f3215ad04a8277ce78a17ea870beb4189e6fee16f36942c25d98ca24e9166e9.exe	32

C:\Users\Admin\AppData\Local\Temp\5f3215ad04a8277ce78a17ea870beb4189e6fee16f36942c25d98ca24e9166e9.exe
"C:\Users\Admin\AppData\Local\Temp\5f3215ad04a8277ce78a17ea870beb4189e6fee16f36942c25d98ca24e9166e9.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2368 -s 1664
  2⤵
  PID:6040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2368-0-0x000007FEF5F53000-0x000007FEF5F54000-memory.dmp

Filesize
4KB

Download
memory/2368-1-0x00000000010F0000-0x0000000001150000-memory.dmp

Filesize
384KB

Download
memory/2368-2-0x000007FEF5F50000-0x000007FEF693C000-memory.dmp

Filesize
9.9MB

Download
memory/2368-3-0x0000000000F90000-0x0000000001092000-memory.dmp

Filesize
1.0MB

Download
memory/2368-4-0x0000000000F90000-0x000000000108B000-memory.dmp

Filesize
1004KB

Download
memory/2368-10-0x0000000000F90000-0x000000000108B000-memory.dmp

Filesize
1004KB

Download
memory/2368-18-0x0000000000F90000-0x000000000108B000-memory.dmp

Filesize
1004KB

Download
memory/2368-29-0x0000000000F90000-0x000000000108B000-memory.dmp

Filesize
1004KB

Download
memory/2368-49-0x0000000000F90000-0x000000000108B000-memory.dmp

Filesize
1004KB

Download
memory/2368-63-0x0000000000F90000-0x000000000108B000-memory.dmp

Filesize
1004KB

Download
memory/2368-67-0x0000000000F90000-0x000000000108B000-memory.dmp

Filesize
1004KB

Download
memory/2368-65-0x0000000000F90000-0x000000000108B000-memory.dmp

Filesize
1004KB

Download
memory/2368-61-0x0000000000F90000-0x000000000108B000-memory.dmp

Filesize
1004KB

Download
memory/2368-59-0x0000000000F90000-0x000000000108B000-memory.dmp

Filesize
1004KB

Download
memory/2368-57-0x0000000000F90000-0x000000000108B000-memory.dmp

Filesize
1004KB

Download
memory/2368-55-0x0000000000F90000-0x000000000108B000-memory.dmp

Filesize
1004KB

Download
memory/2368-53-0x0000000000F90000-0x000000000108B000-memory.dmp

Filesize
1004KB

Download
memory/2368-51-0x0000000000F90000-0x000000000108B000-memory.dmp

Filesize
1004KB

Download
memory/2368-47-0x0000000000F90000-0x000000000108B000-memory.dmp

Filesize
1004KB

Download
memory/2368-45-0x0000000000F90000-0x000000000108B000-memory.dmp

Filesize
1004KB

Download
memory/2368-43-0x0000000000F90000-0x000000000108B000-memory.dmp

Filesize
1004KB

Download
memory/2368-41-0x0000000000F90000-0x000000000108B000-memory.dmp

Filesize
1004KB

Download
memory/2368-40-0x0000000000F90000-0x000000000108B000-memory.dmp

Filesize
1004KB

Download
memory/2368-37-0x0000000000F90000-0x000000000108B000-memory.dmp

Filesize
1004KB

Download
memory/2368-35-0x0000000000F90000-0x000000000108B000-memory.dmp

Filesize
1004KB

Download
memory/2368-33-0x0000000000F90000-0x000000000108B000-memory.dmp

Filesize
1004KB

Download
memory/2368-31-0x0000000000F90000-0x000000000108B000-memory.dmp

Filesize
1004KB

Download
memory/2368-27-0x0000000000F90000-0x000000000108B000-memory.dmp

Filesize
1004KB

Download
memory/2368-25-0x0000000000F90000-0x000000000108B000-memory.dmp

Filesize
1004KB

Download
memory/2368-23-0x0000000000F90000-0x000000000108B000-memory.dmp

Filesize
1004KB

Download
memory/2368-21-0x0000000000F90000-0x000000000108B000-memory.dmp

Filesize
1004KB

Download
memory/2368-19-0x0000000000F90000-0x000000000108B000-memory.dmp

Filesize
1004KB

Download
memory/2368-15-0x0000000000F90000-0x000000000108B000-memory.dmp

Filesize
1004KB

Download
memory/2368-13-0x0000000000F90000-0x000000000108B000-memory.dmp

Filesize
1004KB

Download
memory/2368-11-0x0000000000F90000-0x000000000108B000-memory.dmp

Filesize
1004KB

Download
memory/2368-7-0x0000000000F90000-0x000000000108B000-memory.dmp

Filesize
1004KB

Download
memory/2368-5-0x0000000000F90000-0x000000000108B000-memory.dmp

Filesize
1004KB

Download
memory/2368-1078-0x000007FEF5F50000-0x000007FEF693C000-memory.dmp

Filesize
9.9MB

Download
memory/2368-1080-0x0000000001090000-0x00000000010DC000-memory.dmp

Filesize
304KB

Download
memory/2368-1079-0x000000001AE30000-0x000000001AEAC000-memory.dmp

Filesize
496KB

Download
memory/2368-1081-0x000007FEF5F53000-0x000007FEF5F54000-memory.dmp

Filesize
4KB

Download
memory/2368-1082-0x000007FEF5F50000-0x000007FEF693C000-memory.dmp

Filesize
9.9MB

Download
memory/2368-1083-0x0000000002650000-0x00000000026A4000-memory.dmp

Filesize
336KB

Download