a7973a17712bb6def98c296393e3161073714539744d2b0f6e7b115fe8f05128

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
27-09-2024 10:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a7973a17712bb6def98c296393e3161073714539744d2b0f6e7b115fe8f05128N.exe
Size

361KB
MD5

787ea6002e86cb8b3c7b4a4c0060c500
SHA1

017ac6ff804196bb686fa0c73ca6a4766b6f555b
SHA256

a7973a17712bb6def98c296393e3161073714539744d2b0f6e7b115fe8f05128
SHA512

a095742146b74732ca8e55ae376da3b0bb40ae18f9c19beba73649ae45bbcea5495811f3e34270b68e583921b7ce52355b9370023cdfd3f79d592d503f2bdb9b
SSDEEP

3072:m1Did/y4BPIqk2gh6iP40nP05w+VYuyZ:qid/9V

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
388	a7973a17712bb6def98c296393e3161073714539744d2b0f6e7b115fe8f05128N.exe
388	a7973a17712bb6def98c296393e3161073714539744d2b0f6e7b115fe8f05128N.exe
388	a7973a17712bb6def98c296393e3161073714539744d2b0f6e7b115fe8f05128N.exe
388	a7973a17712bb6def98c296393e3161073714539744d2b0f6e7b115fe8f05128N.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	388	a7973a17712bb6def98c296393e3161073714539744d2b0f6e7b115fe8f05128N.exe
Token: SeDebugPrivilege	388	a7973a17712bb6def98c296393e3161073714539744d2b0f6e7b115fe8f05128N.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 388 wrote to memory of 6040	388	a7973a17712bb6def98c296393e3161073714539744d2b0f6e7b115fe8f05128N.exe	32
PID 388 wrote to memory of 6040	388	a7973a17712bb6def98c296393e3161073714539744d2b0f6e7b115fe8f05128N.exe	32
PID 388 wrote to memory of 6040	388	a7973a17712bb6def98c296393e3161073714539744d2b0f6e7b115fe8f05128N.exe	32

C:\Users\Admin\AppData\Local\Temp\a7973a17712bb6def98c296393e3161073714539744d2b0f6e7b115fe8f05128N.exe
"C:\Users\Admin\AppData\Local\Temp\a7973a17712bb6def98c296393e3161073714539744d2b0f6e7b115fe8f05128N.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:388
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 388 -s 1680
  2⤵
  PID:6040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/388-0-0x000007FEF50B3000-0x000007FEF50B4000-memory.dmp

Filesize
4KB

Download
memory/388-1-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Filesize
384KB

Download
memory/388-2-0x000007FEF50B0000-0x000007FEF5A9C000-memory.dmp

Filesize
9.9MB

Download
memory/388-3-0x000000001C760000-0x000000001C860000-memory.dmp

Filesize
1024KB

Download
memory/388-4-0x000000001C760000-0x000000001C85B000-memory.dmp

Filesize
1004KB

Download
memory/388-17-0x000000001C760000-0x000000001C85B000-memory.dmp

Filesize
1004KB

Download
memory/388-5-0x000000001C760000-0x000000001C85B000-memory.dmp

Filesize
1004KB

Download
memory/388-43-0x000000001C760000-0x000000001C85B000-memory.dmp

Filesize
1004KB

Download
memory/388-49-0x000000001C760000-0x000000001C85B000-memory.dmp

Filesize
1004KB

Download
memory/388-7-0x000000001C760000-0x000000001C85B000-memory.dmp

Filesize
1004KB

Download
memory/388-61-0x000000001C760000-0x000000001C85B000-memory.dmp

Filesize
1004KB

Download
memory/388-9-0x000000001C760000-0x000000001C85B000-memory.dmp

Filesize
1004KB

Download
memory/388-11-0x000000001C760000-0x000000001C85B000-memory.dmp

Filesize
1004KB

Download
memory/388-13-0x000000001C760000-0x000000001C85B000-memory.dmp

Filesize
1004KB

Download
memory/388-15-0x000000001C760000-0x000000001C85B000-memory.dmp

Filesize
1004KB

Download
memory/388-21-0x000000001C760000-0x000000001C85B000-memory.dmp

Filesize
1004KB

Download
memory/388-25-0x000000001C760000-0x000000001C85B000-memory.dmp

Filesize
1004KB

Download
memory/388-29-0x000000001C760000-0x000000001C85B000-memory.dmp

Filesize
1004KB

Download
memory/388-33-0x000000001C760000-0x000000001C85B000-memory.dmp

Filesize
1004KB

Download
memory/388-39-0x000000001C760000-0x000000001C85B000-memory.dmp

Filesize
1004KB

Download
memory/388-45-0x000000001C760000-0x000000001C85B000-memory.dmp

Filesize
1004KB

Download
memory/388-51-0x000000001C760000-0x000000001C85B000-memory.dmp

Filesize
1004KB

Download
memory/388-47-0x000000001C760000-0x000000001C85B000-memory.dmp

Filesize
1004KB

Download
memory/388-41-0x000000001C760000-0x000000001C85B000-memory.dmp

Filesize
1004KB

Download
memory/388-67-0x000000001C760000-0x000000001C85B000-memory.dmp

Filesize
1004KB

Download
memory/388-65-0x000000001C760000-0x000000001C85B000-memory.dmp

Filesize
1004KB

Download
memory/388-63-0x000000001C760000-0x000000001C85B000-memory.dmp

Filesize
1004KB

Download
memory/388-59-0x000000001C760000-0x000000001C85B000-memory.dmp

Filesize
1004KB

Download
memory/388-57-0x000000001C760000-0x000000001C85B000-memory.dmp

Filesize
1004KB

Download
memory/388-55-0x000000001C760000-0x000000001C85B000-memory.dmp

Filesize
1004KB

Download
memory/388-53-0x000000001C760000-0x000000001C85B000-memory.dmp

Filesize
1004KB

Download
memory/388-37-0x000000001C760000-0x000000001C85B000-memory.dmp

Filesize
1004KB

Download
memory/388-35-0x000000001C760000-0x000000001C85B000-memory.dmp

Filesize
1004KB

Download
memory/388-31-0x000000001C760000-0x000000001C85B000-memory.dmp

Filesize
1004KB

Download
memory/388-27-0x000000001C760000-0x000000001C85B000-memory.dmp

Filesize
1004KB

Download
memory/388-23-0x000000001C760000-0x000000001C85B000-memory.dmp

Filesize
1004KB

Download
memory/388-19-0x000000001C760000-0x000000001C85B000-memory.dmp

Filesize
1004KB

Download
memory/388-1078-0x000007FEF50B0000-0x000007FEF5A9C000-memory.dmp

Filesize
9.9MB

Download
memory/388-1079-0x000000001BDD0000-0x000000001BE4C000-memory.dmp

Filesize
496KB

Download
memory/388-1080-0x0000000002430000-0x000000000247C000-memory.dmp

Filesize
304KB

Download
memory/388-1081-0x000007FEF50B3000-0x000007FEF50B4000-memory.dmp

Filesize
4KB

Download
memory/388-1082-0x000007FEF50B0000-0x000007FEF5A9C000-memory.dmp

Filesize
9.9MB

Download
memory/388-1083-0x000000001AC20000-0x000000001AC74000-memory.dmp

Filesize
336KB

Download