922ff7b2589cfa1d6a8dcd706bc294be4d4cb4d9baf02df5717d121097ab1859

Analysis

max time kernel
64s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-09-2024 10:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

922ff7b2589cfa1d6a8dcd706bc294be4d4cb4d9baf02df5717d121097ab1859.exe
Size

353KB
MD5

631691dca7abc573a0cc911b2ddca40e
SHA1

0ddc497bb233cda946e320378cde5e5cc507eb72
SHA256

922ff7b2589cfa1d6a8dcd706bc294be4d4cb4d9baf02df5717d121097ab1859
SHA512

4a94910b35a95038ba787095970ee32281011021f3cd33066bc8b350c2b1824e1f67a303492fbaae41e9872e75667325e3a4b8d759dce3a79105a00a09782dd9
SSDEEP

768:BiHqbOcbd5LGOcccCM8AMx9m24IeGFfRhQg2ZzEjss2VSg1I1cn0sspAgpq8hLy8:oHqbbJGwrThRhQ7qPpqOLy0uyL+fS

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
820	922ff7b2589cfa1d6a8dcd706bc294be4d4cb4d9baf02df5717d121097ab1859.exe
820	922ff7b2589cfa1d6a8dcd706bc294be4d4cb4d9baf02df5717d121097ab1859.exe
820	922ff7b2589cfa1d6a8dcd706bc294be4d4cb4d9baf02df5717d121097ab1859.exe
820	922ff7b2589cfa1d6a8dcd706bc294be4d4cb4d9baf02df5717d121097ab1859.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	820	922ff7b2589cfa1d6a8dcd706bc294be4d4cb4d9baf02df5717d121097ab1859.exe
Token: SeDebugPrivilege	820	922ff7b2589cfa1d6a8dcd706bc294be4d4cb4d9baf02df5717d121097ab1859.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 820 wrote to memory of 4976	820	922ff7b2589cfa1d6a8dcd706bc294be4d4cb4d9baf02df5717d121097ab1859.exe	31
PID 820 wrote to memory of 4976	820	922ff7b2589cfa1d6a8dcd706bc294be4d4cb4d9baf02df5717d121097ab1859.exe	31
PID 820 wrote to memory of 4976	820	922ff7b2589cfa1d6a8dcd706bc294be4d4cb4d9baf02df5717d121097ab1859.exe	31

C:\Users\Admin\AppData\Local\Temp\922ff7b2589cfa1d6a8dcd706bc294be4d4cb4d9baf02df5717d121097ab1859.exe
"C:\Users\Admin\AppData\Local\Temp\922ff7b2589cfa1d6a8dcd706bc294be4d4cb4d9baf02df5717d121097ab1859.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:820
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 820 -s 1608
  2⤵
  PID:4976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/820-0-0x000007FEF4C13000-0x000007FEF4C14000-memory.dmp

Filesize
4KB

Download
memory/820-1-0x0000000000CB0000-0x0000000000D0C000-memory.dmp

Filesize
368KB

Download
memory/820-2-0x000007FEF4C10000-0x000007FEF55FC000-memory.dmp

Filesize
9.9MB

Download
memory/820-3-0x000000001B2E0000-0x000000001B3E2000-memory.dmp

Filesize
1.0MB

Download
memory/820-4-0x000000001B2E0000-0x000000001B3DB000-memory.dmp

Filesize
1004KB

Download
memory/820-21-0x000000001B2E0000-0x000000001B3DB000-memory.dmp

Filesize
1004KB

Download
memory/820-29-0x000000001B2E0000-0x000000001B3DB000-memory.dmp

Filesize
1004KB

Download
memory/820-39-0x000000001B2E0000-0x000000001B3DB000-memory.dmp

Filesize
1004KB

Download
memory/820-37-0x000000001B2E0000-0x000000001B3DB000-memory.dmp

Filesize
1004KB

Download
memory/820-35-0x000000001B2E0000-0x000000001B3DB000-memory.dmp

Filesize
1004KB

Download
memory/820-33-0x000000001B2E0000-0x000000001B3DB000-memory.dmp

Filesize
1004KB

Download
memory/820-31-0x000000001B2E0000-0x000000001B3DB000-memory.dmp

Filesize
1004KB

Download
memory/820-27-0x000000001B2E0000-0x000000001B3DB000-memory.dmp

Filesize
1004KB

Download
memory/820-25-0x000000001B2E0000-0x000000001B3DB000-memory.dmp

Filesize
1004KB

Download
memory/820-23-0x000000001B2E0000-0x000000001B3DB000-memory.dmp

Filesize
1004KB

Download
memory/820-19-0x000000001B2E0000-0x000000001B3DB000-memory.dmp

Filesize
1004KB

Download
memory/820-17-0x000000001B2E0000-0x000000001B3DB000-memory.dmp

Filesize
1004KB

Download
memory/820-15-0x000000001B2E0000-0x000000001B3DB000-memory.dmp

Filesize
1004KB

Download
memory/820-13-0x000000001B2E0000-0x000000001B3DB000-memory.dmp

Filesize
1004KB

Download
memory/820-11-0x000000001B2E0000-0x000000001B3DB000-memory.dmp

Filesize
1004KB

Download
memory/820-9-0x000000001B2E0000-0x000000001B3DB000-memory.dmp

Filesize
1004KB

Download
memory/820-7-0x000000001B2E0000-0x000000001B3DB000-memory.dmp

Filesize
1004KB

Download
memory/820-5-0x000000001B2E0000-0x000000001B3DB000-memory.dmp

Filesize
1004KB

Download
memory/820-67-0x000000001B2E0000-0x000000001B3DB000-memory.dmp

Filesize
1004KB

Download
memory/820-65-0x000000001B2E0000-0x000000001B3DB000-memory.dmp

Filesize
1004KB

Download
memory/820-63-0x000000001B2E0000-0x000000001B3DB000-memory.dmp

Filesize
1004KB

Download
memory/820-61-0x000000001B2E0000-0x000000001B3DB000-memory.dmp

Filesize
1004KB

Download
memory/820-59-0x000000001B2E0000-0x000000001B3DB000-memory.dmp

Filesize
1004KB

Download
memory/820-57-0x000000001B2E0000-0x000000001B3DB000-memory.dmp

Filesize
1004KB

Download
memory/820-55-0x000000001B2E0000-0x000000001B3DB000-memory.dmp

Filesize
1004KB

Download
memory/820-53-0x000000001B2E0000-0x000000001B3DB000-memory.dmp

Filesize
1004KB

Download
memory/820-51-0x000000001B2E0000-0x000000001B3DB000-memory.dmp

Filesize
1004KB

Download
memory/820-49-0x000000001B2E0000-0x000000001B3DB000-memory.dmp

Filesize
1004KB

Download
memory/820-47-0x000000001B2E0000-0x000000001B3DB000-memory.dmp

Filesize
1004KB

Download
memory/820-45-0x000000001B2E0000-0x000000001B3DB000-memory.dmp

Filesize
1004KB

Download
memory/820-43-0x000000001B2E0000-0x000000001B3DB000-memory.dmp

Filesize
1004KB

Download
memory/820-41-0x000000001B2E0000-0x000000001B3DB000-memory.dmp

Filesize
1004KB

Download
memory/820-228-0x000007FEF4C13000-0x000007FEF4C14000-memory.dmp

Filesize
4KB

Download
memory/820-271-0x000007FEF4C10000-0x000007FEF55FC000-memory.dmp

Filesize
9.9MB

Download
memory/820-1080-0x000007FEF4C10000-0x000007FEF55FC000-memory.dmp

Filesize
9.9MB

Download
memory/820-1081-0x000000001BD90000-0x000000001BE0C000-memory.dmp

Filesize
496KB

Download
memory/820-1082-0x000000001ADD0000-0x000000001AE1C000-memory.dmp

Filesize
304KB

Download
memory/820-1083-0x000007FEF4C10000-0x000007FEF55FC000-memory.dmp

Filesize
9.9MB

Download
memory/820-1084-0x000000001BE10000-0x000000001BE64000-memory.dmp

Filesize
336KB

Download