df6b8ec2501a31a2545d2e3a7033cd403e32c94f9afe15798e0fb53d76f758d9

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-10-2024 15:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df6b8ec2501a31a2545d2e3a7033cd403e32c94f9afe15798e0fb53d76f758d9.exe
Size

1.1MB
MD5

0b637b2700d31bc9bfee3d704af90762
SHA1

1eb843422fe6d469060f4d9be996b32dd47eb0f6
SHA256

df6b8ec2501a31a2545d2e3a7033cd403e32c94f9afe15798e0fb53d76f758d9
SHA512

9a14dcf7b785ed7a7176a1ff18e6f0060943229ab65061800efbbc9c9409b5cb93cd452bf95ed7efe41745bfdf4f06449cb4991bc154892e2d982da6916e4d7d
SSDEEP

24576:kAnzzufFdlZl59t1VNdDPEnF6XKDAOe4H444l:kaGfFdlZl59t1VNdDPBXK+4H444l

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1564	df6b8ec2501a31a2545d2e3a7033cd403e32c94f9afe15798e0fb53d76f758d9.exe
1564	df6b8ec2501a31a2545d2e3a7033cd403e32c94f9afe15798e0fb53d76f758d9.exe
1564	df6b8ec2501a31a2545d2e3a7033cd403e32c94f9afe15798e0fb53d76f758d9.exe
1564	df6b8ec2501a31a2545d2e3a7033cd403e32c94f9afe15798e0fb53d76f758d9.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1564	df6b8ec2501a31a2545d2e3a7033cd403e32c94f9afe15798e0fb53d76f758d9.exe
Token: SeDebugPrivilege	1564	df6b8ec2501a31a2545d2e3a7033cd403e32c94f9afe15798e0fb53d76f758d9.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 3580	1564	df6b8ec2501a31a2545d2e3a7033cd403e32c94f9afe15798e0fb53d76f758d9.exe	30
PID 1564 wrote to memory of 3580	1564	df6b8ec2501a31a2545d2e3a7033cd403e32c94f9afe15798e0fb53d76f758d9.exe	30
PID 1564 wrote to memory of 3580	1564	df6b8ec2501a31a2545d2e3a7033cd403e32c94f9afe15798e0fb53d76f758d9.exe	30

C:\Users\Admin\AppData\Local\Temp\df6b8ec2501a31a2545d2e3a7033cd403e32c94f9afe15798e0fb53d76f758d9.exe
"C:\Users\Admin\AppData\Local\Temp\df6b8ec2501a31a2545d2e3a7033cd403e32c94f9afe15798e0fb53d76f758d9.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1564 -s 1604
  2⤵
  PID:3580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1564-2-0x000007FEF57E0000-0x000007FEF61CC000-memory.dmp

Filesize
9.9MB

Download
memory/1564-1-0x00000000003F0000-0x000000000051C000-memory.dmp

Filesize
1.2MB

Download
memory/1564-0-0x000007FEF57E3000-0x000007FEF57E4000-memory.dmp

Filesize
4KB

Download
memory/1564-3-0x000000001B8D0000-0x000000001B9D2000-memory.dmp

Filesize
1.0MB

Download
memory/1564-4-0x000000001B8D0000-0x000000001B9CB000-memory.dmp

Filesize
1004KB

Download
memory/1564-7-0x000000001B8D0000-0x000000001B9CB000-memory.dmp

Filesize
1004KB

Download
memory/1564-29-0x000000001B8D0000-0x000000001B9CB000-memory.dmp

Filesize
1004KB

Download
memory/1564-39-0x000000001B8D0000-0x000000001B9CB000-memory.dmp

Filesize
1004KB

Download
memory/1564-51-0x000000001B8D0000-0x000000001B9CB000-memory.dmp

Filesize
1004KB

Download
memory/1564-61-0x000000001B8D0000-0x000000001B9CB000-memory.dmp

Filesize
1004KB

Download
memory/1564-5-0x000000001B8D0000-0x000000001B9CB000-memory.dmp

Filesize
1004KB

Download
memory/1564-9-0x000000001B8D0000-0x000000001B9CB000-memory.dmp

Filesize
1004KB

Download
memory/1564-63-0x000000001B8D0000-0x000000001B9CB000-memory.dmp

Filesize
1004KB

Download
memory/1564-59-0x000000001B8D0000-0x000000001B9CB000-memory.dmp

Filesize
1004KB

Download
memory/1564-67-0x000000001B8D0000-0x000000001B9CB000-memory.dmp

Filesize
1004KB

Download
memory/1564-57-0x000000001B8D0000-0x000000001B9CB000-memory.dmp

Filesize
1004KB

Download
memory/1564-55-0x000000001B8D0000-0x000000001B9CB000-memory.dmp

Filesize
1004KB

Download
memory/1564-53-0x000000001B8D0000-0x000000001B9CB000-memory.dmp

Filesize
1004KB

Download
memory/1564-49-0x000000001B8D0000-0x000000001B9CB000-memory.dmp

Filesize
1004KB

Download
memory/1564-47-0x000000001B8D0000-0x000000001B9CB000-memory.dmp

Filesize
1004KB

Download
memory/1564-45-0x000000001B8D0000-0x000000001B9CB000-memory.dmp

Filesize
1004KB

Download
memory/1564-43-0x000000001B8D0000-0x000000001B9CB000-memory.dmp

Filesize
1004KB

Download
memory/1564-41-0x000000001B8D0000-0x000000001B9CB000-memory.dmp

Filesize
1004KB

Download
memory/1564-37-0x000000001B8D0000-0x000000001B9CB000-memory.dmp

Filesize
1004KB

Download
memory/1564-35-0x000000001B8D0000-0x000000001B9CB000-memory.dmp

Filesize
1004KB

Download
memory/1564-33-0x000000001B8D0000-0x000000001B9CB000-memory.dmp

Filesize
1004KB

Download
memory/1564-31-0x000000001B8D0000-0x000000001B9CB000-memory.dmp

Filesize
1004KB

Download
memory/1564-27-0x000000001B8D0000-0x000000001B9CB000-memory.dmp

Filesize
1004KB

Download
memory/1564-25-0x000000001B8D0000-0x000000001B9CB000-memory.dmp

Filesize
1004KB

Download
memory/1564-23-0x000000001B8D0000-0x000000001B9CB000-memory.dmp

Filesize
1004KB

Download
memory/1564-21-0x000000001B8D0000-0x000000001B9CB000-memory.dmp

Filesize
1004KB

Download
memory/1564-19-0x000000001B8D0000-0x000000001B9CB000-memory.dmp

Filesize
1004KB

Download
memory/1564-17-0x000000001B8D0000-0x000000001B9CB000-memory.dmp

Filesize
1004KB

Download
memory/1564-15-0x000000001B8D0000-0x000000001B9CB000-memory.dmp

Filesize
1004KB

Download
memory/1564-13-0x000000001B8D0000-0x000000001B9CB000-memory.dmp

Filesize
1004KB

Download
memory/1564-11-0x000000001B8D0000-0x000000001B9CB000-memory.dmp

Filesize
1004KB

Download
memory/1564-65-0x000000001B8D0000-0x000000001B9CB000-memory.dmp

Filesize
1004KB

Download
memory/1564-1078-0x000007FEF57E0000-0x000007FEF61CC000-memory.dmp

Filesize
9.9MB

Download
memory/1564-1080-0x000000001BE10000-0x000000001BE5C000-memory.dmp

Filesize
304KB

Download
memory/1564-1079-0x000000001B9F0000-0x000000001BA6C000-memory.dmp

Filesize
496KB

Download
memory/1564-1081-0x000007FEF57E3000-0x000007FEF57E4000-memory.dmp

Filesize
4KB

Download
memory/1564-1082-0x000007FEF57E0000-0x000007FEF61CC000-memory.dmp

Filesize
9.9MB

Download
memory/1564-1083-0x000000001C3E0000-0x000000001C434000-memory.dmp

Filesize
336KB

Download
memory/1564-1084-0x000007FEF57E0000-0x000007FEF61CC000-memory.dmp

Filesize
9.9MB

Download