922ff7b2589cfa1d6a8dcd706bc294be4d4cb4d9baf02df5717d121097ab1859

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-09-2024 01:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

922ff7b2589cfa1d6a8dcd706bc294be4d4cb4d9baf02df5717d121097ab1859.exe
Size

353KB
MD5

631691dca7abc573a0cc911b2ddca40e
SHA1

0ddc497bb233cda946e320378cde5e5cc507eb72
SHA256

922ff7b2589cfa1d6a8dcd706bc294be4d4cb4d9baf02df5717d121097ab1859
SHA512

4a94910b35a95038ba787095970ee32281011021f3cd33066bc8b350c2b1824e1f67a303492fbaae41e9872e75667325e3a4b8d759dce3a79105a00a09782dd9
SSDEEP

768:BiHqbOcbd5LGOcccCM8AMx9m24IeGFfRhQg2ZzEjss2VSg1I1cn0sspAgpq8hLy8:oHqbbJGwrThRhQ7qPpqOLy0uyL+fS

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2832	922ff7b2589cfa1d6a8dcd706bc294be4d4cb4d9baf02df5717d121097ab1859.exe
2832	922ff7b2589cfa1d6a8dcd706bc294be4d4cb4d9baf02df5717d121097ab1859.exe
2832	922ff7b2589cfa1d6a8dcd706bc294be4d4cb4d9baf02df5717d121097ab1859.exe
2832	922ff7b2589cfa1d6a8dcd706bc294be4d4cb4d9baf02df5717d121097ab1859.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2832	922ff7b2589cfa1d6a8dcd706bc294be4d4cb4d9baf02df5717d121097ab1859.exe
Token: SeDebugPrivilege	2832	922ff7b2589cfa1d6a8dcd706bc294be4d4cb4d9baf02df5717d121097ab1859.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 6108	2832	922ff7b2589cfa1d6a8dcd706bc294be4d4cb4d9baf02df5717d121097ab1859.exe	32
PID 2832 wrote to memory of 6108	2832	922ff7b2589cfa1d6a8dcd706bc294be4d4cb4d9baf02df5717d121097ab1859.exe	32
PID 2832 wrote to memory of 6108	2832	922ff7b2589cfa1d6a8dcd706bc294be4d4cb4d9baf02df5717d121097ab1859.exe	32

C:\Users\Admin\AppData\Local\Temp\922ff7b2589cfa1d6a8dcd706bc294be4d4cb4d9baf02df5717d121097ab1859.exe
"C:\Users\Admin\AppData\Local\Temp\922ff7b2589cfa1d6a8dcd706bc294be4d4cb4d9baf02df5717d121097ab1859.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2832 -s 1632
  2⤵
  PID:6108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2832-0-0x000007FEF5A13000-0x000007FEF5A14000-memory.dmp

Filesize
4KB

Download
memory/2832-1-0x00000000011D0000-0x000000000122C000-memory.dmp

Filesize
368KB

Download
memory/2832-2-0x000007FEF5A10000-0x000007FEF63FC000-memory.dmp

Filesize
9.9MB

Download
memory/2832-3-0x000000001D850000-0x000000001D952000-memory.dmp

Filesize
1.0MB

Download
memory/2832-9-0x000000001D850000-0x000000001D94B000-memory.dmp

Filesize
1004KB

Download
memory/2832-4-0x000000001D850000-0x000000001D94B000-memory.dmp

Filesize
1004KB

Download
memory/2832-21-0x000000001D850000-0x000000001D94B000-memory.dmp

Filesize
1004KB

Download
memory/2832-5-0x000000001D850000-0x000000001D94B000-memory.dmp

Filesize
1004KB

Download
memory/2832-31-0x000000001D850000-0x000000001D94B000-memory.dmp

Filesize
1004KB

Download
memory/2832-7-0x000000001D850000-0x000000001D94B000-memory.dmp

Filesize
1004KB

Download
memory/2832-11-0x000000001D850000-0x000000001D94B000-memory.dmp

Filesize
1004KB

Download
memory/2832-15-0x000000001D850000-0x000000001D94B000-memory.dmp

Filesize
1004KB

Download
memory/2832-17-0x000000001D850000-0x000000001D94B000-memory.dmp

Filesize
1004KB

Download
memory/2832-19-0x000000001D850000-0x000000001D94B000-memory.dmp

Filesize
1004KB

Download
memory/2832-33-0x000000001D850000-0x000000001D94B000-memory.dmp

Filesize
1004KB

Download
memory/2832-29-0x000000001D850000-0x000000001D94B000-memory.dmp

Filesize
1004KB

Download
memory/2832-27-0x000000001D850000-0x000000001D94B000-memory.dmp

Filesize
1004KB

Download
memory/2832-25-0x000000001D850000-0x000000001D94B000-memory.dmp

Filesize
1004KB

Download
memory/2832-23-0x000000001D850000-0x000000001D94B000-memory.dmp

Filesize
1004KB

Download
memory/2832-51-0x000000001D850000-0x000000001D94B000-memory.dmp

Filesize
1004KB

Download
memory/2832-49-0x000000001D850000-0x000000001D94B000-memory.dmp

Filesize
1004KB

Download
memory/2832-47-0x000000001D850000-0x000000001D94B000-memory.dmp

Filesize
1004KB

Download
memory/2832-46-0x000000001D850000-0x000000001D94B000-memory.dmp

Filesize
1004KB

Download
memory/2832-43-0x000000001D850000-0x000000001D94B000-memory.dmp

Filesize
1004KB

Download
memory/2832-41-0x000000001D850000-0x000000001D94B000-memory.dmp

Filesize
1004KB

Download
memory/2832-39-0x000000001D850000-0x000000001D94B000-memory.dmp

Filesize
1004KB

Download
memory/2832-37-0x000000001D850000-0x000000001D94B000-memory.dmp

Filesize
1004KB

Download
memory/2832-35-0x000000001D850000-0x000000001D94B000-memory.dmp

Filesize
1004KB

Download
memory/2832-13-0x000000001D850000-0x000000001D94B000-memory.dmp

Filesize
1004KB

Download
memory/2832-61-0x000000001D850000-0x000000001D94B000-memory.dmp

Filesize
1004KB

Download
memory/2832-63-0x000000001D850000-0x000000001D94B000-memory.dmp

Filesize
1004KB

Download
memory/2832-53-0x000000001D850000-0x000000001D94B000-memory.dmp

Filesize
1004KB

Download
memory/2832-55-0x000000001D850000-0x000000001D94B000-memory.dmp

Filesize
1004KB

Download
memory/2832-57-0x000000001D850000-0x000000001D94B000-memory.dmp

Filesize
1004KB

Download
memory/2832-59-0x000000001D850000-0x000000001D94B000-memory.dmp

Filesize
1004KB

Download
memory/2832-65-0x000000001D850000-0x000000001D94B000-memory.dmp

Filesize
1004KB

Download
memory/2832-67-0x000000001D850000-0x000000001D94B000-memory.dmp

Filesize
1004KB

Download
memory/2832-1078-0x000007FEF5A10000-0x000007FEF63FC000-memory.dmp

Filesize
9.9MB

Download
memory/2832-1079-0x000000001BAF0000-0x000000001BB6C000-memory.dmp

Filesize
496KB

Download
memory/2832-1080-0x0000000000DB0000-0x0000000000DFC000-memory.dmp

Filesize
304KB

Download
memory/2832-1081-0x000007FEF5A13000-0x000007FEF5A14000-memory.dmp

Filesize
4KB

Download
memory/2832-1082-0x000007FEF5A10000-0x000007FEF63FC000-memory.dmp

Filesize
9.9MB

Download
memory/2832-1083-0x000000001B330000-0x000000001B384000-memory.dmp

Filesize
336KB

Download