a7973a17712bb6def98c296393e3161073714539744d2b0f6e7b115fe8f05128

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26-09-2024 02:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a7973a17712bb6def98c296393e3161073714539744d2b0f6e7b115fe8f05128.exe
Size

361KB
MD5

787ea6002e86cb8b3c7b4a4c0060c500
SHA1

017ac6ff804196bb686fa0c73ca6a4766b6f555b
SHA256

a7973a17712bb6def98c296393e3161073714539744d2b0f6e7b115fe8f05128
SHA512

a095742146b74732ca8e55ae376da3b0bb40ae18f9c19beba73649ae45bbcea5495811f3e34270b68e583921b7ce52355b9370023cdfd3f79d592d503f2bdb9b
SSDEEP

3072:m1Did/y4BPIqk2gh6iP40nP05w+VYuyZ:qid/9V

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2876	a7973a17712bb6def98c296393e3161073714539744d2b0f6e7b115fe8f05128.exe
2876	a7973a17712bb6def98c296393e3161073714539744d2b0f6e7b115fe8f05128.exe
2876	a7973a17712bb6def98c296393e3161073714539744d2b0f6e7b115fe8f05128.exe
2876	a7973a17712bb6def98c296393e3161073714539744d2b0f6e7b115fe8f05128.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2876	a7973a17712bb6def98c296393e3161073714539744d2b0f6e7b115fe8f05128.exe
Token: SeDebugPrivilege	2876	a7973a17712bb6def98c296393e3161073714539744d2b0f6e7b115fe8f05128.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 5976	2876	a7973a17712bb6def98c296393e3161073714539744d2b0f6e7b115fe8f05128.exe	32
PID 2876 wrote to memory of 5976	2876	a7973a17712bb6def98c296393e3161073714539744d2b0f6e7b115fe8f05128.exe	32
PID 2876 wrote to memory of 5976	2876	a7973a17712bb6def98c296393e3161073714539744d2b0f6e7b115fe8f05128.exe	32

C:\Users\Admin\AppData\Local\Temp\a7973a17712bb6def98c296393e3161073714539744d2b0f6e7b115fe8f05128.exe
"C:\Users\Admin\AppData\Local\Temp\a7973a17712bb6def98c296393e3161073714539744d2b0f6e7b115fe8f05128.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2876 -s 1676
  2⤵
  PID:5976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2876-0-0x000007FEF5D93000-0x000007FEF5D94000-memory.dmp

Filesize
4KB

Download
memory/2876-1-0x0000000000FA0000-0x0000000001000000-memory.dmp

Filesize
384KB

Download
memory/2876-2-0x000007FEF5D90000-0x000007FEF677C000-memory.dmp

Filesize
9.9MB

Download
memory/2876-3-0x000000001E660000-0x000000001E760000-memory.dmp

Filesize
1024KB

Download
memory/2876-4-0x000000001E660000-0x000000001E75B000-memory.dmp

Filesize
1004KB

Download
memory/2876-5-0x000000001E660000-0x000000001E75B000-memory.dmp

Filesize
1004KB

Download
memory/2876-41-0x000000001E660000-0x000000001E75B000-memory.dmp

Filesize
1004KB

Download
memory/2876-57-0x000000001E660000-0x000000001E75B000-memory.dmp

Filesize
1004KB

Download
memory/2876-7-0x000000001E660000-0x000000001E75B000-memory.dmp

Filesize
1004KB

Download
memory/2876-59-0x000000001E660000-0x000000001E75B000-memory.dmp

Filesize
1004KB

Download
memory/2876-11-0x000000001E660000-0x000000001E75B000-memory.dmp

Filesize
1004KB

Download
memory/2876-51-0x000000001E660000-0x000000001E75B000-memory.dmp

Filesize
1004KB

Download
memory/2876-67-0x000000001E660000-0x000000001E75B000-memory.dmp

Filesize
1004KB

Download
memory/2876-65-0x000000001E660000-0x000000001E75B000-memory.dmp

Filesize
1004KB

Download
memory/2876-63-0x000000001E660000-0x000000001E75B000-memory.dmp

Filesize
1004KB

Download
memory/2876-61-0x000000001E660000-0x000000001E75B000-memory.dmp

Filesize
1004KB

Download
memory/2876-55-0x000000001E660000-0x000000001E75B000-memory.dmp

Filesize
1004KB

Download
memory/2876-53-0x000000001E660000-0x000000001E75B000-memory.dmp

Filesize
1004KB

Download
memory/2876-49-0x000000001E660000-0x000000001E75B000-memory.dmp

Filesize
1004KB

Download
memory/2876-47-0x000000001E660000-0x000000001E75B000-memory.dmp

Filesize
1004KB

Download
memory/2876-45-0x000000001E660000-0x000000001E75B000-memory.dmp

Filesize
1004KB

Download
memory/2876-43-0x000000001E660000-0x000000001E75B000-memory.dmp

Filesize
1004KB

Download
memory/2876-39-0x000000001E660000-0x000000001E75B000-memory.dmp

Filesize
1004KB

Download
memory/2876-37-0x000000001E660000-0x000000001E75B000-memory.dmp

Filesize
1004KB

Download
memory/2876-35-0x000000001E660000-0x000000001E75B000-memory.dmp

Filesize
1004KB

Download
memory/2876-33-0x000000001E660000-0x000000001E75B000-memory.dmp

Filesize
1004KB

Download
memory/2876-31-0x000000001E660000-0x000000001E75B000-memory.dmp

Filesize
1004KB

Download
memory/2876-29-0x000000001E660000-0x000000001E75B000-memory.dmp

Filesize
1004KB

Download
memory/2876-27-0x000000001E660000-0x000000001E75B000-memory.dmp

Filesize
1004KB

Download
memory/2876-25-0x000000001E660000-0x000000001E75B000-memory.dmp

Filesize
1004KB

Download
memory/2876-23-0x000000001E660000-0x000000001E75B000-memory.dmp

Filesize
1004KB

Download
memory/2876-21-0x000000001E660000-0x000000001E75B000-memory.dmp

Filesize
1004KB

Download
memory/2876-19-0x000000001E660000-0x000000001E75B000-memory.dmp

Filesize
1004KB

Download
memory/2876-17-0x000000001E660000-0x000000001E75B000-memory.dmp

Filesize
1004KB

Download
memory/2876-15-0x000000001E660000-0x000000001E75B000-memory.dmp

Filesize
1004KB

Download
memory/2876-13-0x000000001E660000-0x000000001E75B000-memory.dmp

Filesize
1004KB

Download
memory/2876-9-0x000000001E660000-0x000000001E75B000-memory.dmp

Filesize
1004KB

Download
memory/2876-1078-0x000007FEF5D90000-0x000007FEF677C000-memory.dmp

Filesize
9.9MB

Download
memory/2876-1079-0x000000001CB60000-0x000000001CBDC000-memory.dmp

Filesize
496KB

Download
memory/2876-1080-0x0000000000610000-0x000000000065C000-memory.dmp

Filesize
304KB

Download
memory/2876-1081-0x000007FEF5D93000-0x000007FEF5D94000-memory.dmp

Filesize
4KB

Download
memory/2876-1082-0x000007FEF5D90000-0x000007FEF677C000-memory.dmp

Filesize
9.9MB

Download
memory/2876-1083-0x0000000000F50000-0x0000000000FA4000-memory.dmp

Filesize
336KB

Download
memory/2876-1084-0x000007FEF5D90000-0x000007FEF677C000-memory.dmp

Filesize
9.9MB

Download