6e8a33ff639cf191c8e762b736486de1c16eb87e11076d64b8653a2500ca2226

Analysis

max time kernel
67s
max time network
72s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
14-11-2024 02:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e8a33ff639cf191c8e762b736486de1c16eb87e11076d64b8653a2500ca2226.exe
Size

962KB
MD5

ca5a16ada3b5c25a684822ae515eba03
SHA1

3402ea198ecf20cb711ffd8abd56922cd0df222d
SHA256

6e8a33ff639cf191c8e762b736486de1c16eb87e11076d64b8653a2500ca2226
SHA512

f0cfa0fe9057e1af4609f6fadb9be872f763cba0550c31577ede76ce7d1cf5b5fd1aa8a1380b591d48badc7cd7a7a312f61250b03aefd3ef41b59e99c20736cf
SSDEEP

12288:kdbu/see6OOkXd4Ms/9rleBsOagCqv/bZBXxhLSfspxW:+u/see6nkXd4lVrlecgPbjX7+3

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2116	6e8a33ff639cf191c8e762b736486de1c16eb87e11076d64b8653a2500ca2226.exe
2116	6e8a33ff639cf191c8e762b736486de1c16eb87e11076d64b8653a2500ca2226.exe
2116	6e8a33ff639cf191c8e762b736486de1c16eb87e11076d64b8653a2500ca2226.exe
2116	6e8a33ff639cf191c8e762b736486de1c16eb87e11076d64b8653a2500ca2226.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2116	6e8a33ff639cf191c8e762b736486de1c16eb87e11076d64b8653a2500ca2226.exe
Token: SeDebugPrivilege	2116	6e8a33ff639cf191c8e762b736486de1c16eb87e11076d64b8653a2500ca2226.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 4908	2116	6e8a33ff639cf191c8e762b736486de1c16eb87e11076d64b8653a2500ca2226.exe	31
PID 2116 wrote to memory of 4908	2116	6e8a33ff639cf191c8e762b736486de1c16eb87e11076d64b8653a2500ca2226.exe	31
PID 2116 wrote to memory of 4908	2116	6e8a33ff639cf191c8e762b736486de1c16eb87e11076d64b8653a2500ca2226.exe	31

C:\Users\Admin\AppData\Local\Temp\6e8a33ff639cf191c8e762b736486de1c16eb87e11076d64b8653a2500ca2226.exe
"C:\Users\Admin\AppData\Local\Temp\6e8a33ff639cf191c8e762b736486de1c16eb87e11076d64b8653a2500ca2226.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2116 -s 1040
  2⤵
  PID:4908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2116-0-0x000007FEF5A63000-0x000007FEF5A64000-memory.dmp

Filesize
4KB

Download
memory/2116-1-0x0000000000ED0000-0x0000000000FC4000-memory.dmp

Filesize
976KB

Download
memory/2116-2-0x000007FEF5A60000-0x000007FEF644C000-memory.dmp

Filesize
9.9MB

Download
memory/2116-3-0x000000001C730000-0x000000001C838000-memory.dmp

Filesize
1.0MB

Download
memory/2116-9-0x000000001C730000-0x000000001C832000-memory.dmp

Filesize
1.0MB

Download
memory/2116-4-0x000000001C730000-0x000000001C832000-memory.dmp

Filesize
1.0MB

Download
memory/2116-13-0x000000001C730000-0x000000001C832000-memory.dmp

Filesize
1.0MB

Download
memory/2116-11-0x000000001C730000-0x000000001C832000-memory.dmp

Filesize
1.0MB

Download
memory/2116-15-0x000000001C730000-0x000000001C832000-memory.dmp

Filesize
1.0MB

Download
memory/2116-17-0x000000001C730000-0x000000001C832000-memory.dmp

Filesize
1.0MB

Download
memory/2116-7-0x000000001C730000-0x000000001C832000-memory.dmp

Filesize
1.0MB

Download
memory/2116-19-0x000000001C730000-0x000000001C832000-memory.dmp

Filesize
1.0MB

Download
memory/2116-21-0x000000001C730000-0x000000001C832000-memory.dmp

Filesize
1.0MB

Download
memory/2116-5-0x000000001C730000-0x000000001C832000-memory.dmp

Filesize
1.0MB

Download
memory/2116-23-0x000000001C730000-0x000000001C832000-memory.dmp

Filesize
1.0MB

Download
memory/2116-25-0x000000001C730000-0x000000001C832000-memory.dmp

Filesize
1.0MB

Download
memory/2116-27-0x000000001C730000-0x000000001C832000-memory.dmp

Filesize
1.0MB

Download
memory/2116-37-0x000000001C730000-0x000000001C832000-memory.dmp

Filesize
1.0MB

Download
memory/2116-35-0x000000001C730000-0x000000001C832000-memory.dmp

Filesize
1.0MB

Download
memory/2116-33-0x000000001C730000-0x000000001C832000-memory.dmp

Filesize
1.0MB

Download
memory/2116-29-0x000000001C730000-0x000000001C832000-memory.dmp

Filesize
1.0MB

Download
memory/2116-39-0x000000001C730000-0x000000001C832000-memory.dmp

Filesize
1.0MB

Download
memory/2116-41-0x000000001C730000-0x000000001C832000-memory.dmp

Filesize
1.0MB

Download
memory/2116-43-0x000000001C730000-0x000000001C832000-memory.dmp

Filesize
1.0MB

Download
memory/2116-45-0x000000001C730000-0x000000001C832000-memory.dmp

Filesize
1.0MB

Download
memory/2116-61-0x000000001C730000-0x000000001C832000-memory.dmp

Filesize
1.0MB

Download
memory/2116-31-0x000000001C730000-0x000000001C832000-memory.dmp

Filesize
1.0MB

Download
memory/2116-67-0x000000001C730000-0x000000001C832000-memory.dmp

Filesize
1.0MB

Download
memory/2116-65-0x000000001C730000-0x000000001C832000-memory.dmp

Filesize
1.0MB

Download
memory/2116-63-0x000000001C730000-0x000000001C832000-memory.dmp

Filesize
1.0MB

Download
memory/2116-59-0x000000001C730000-0x000000001C832000-memory.dmp

Filesize
1.0MB

Download
memory/2116-57-0x000000001C730000-0x000000001C832000-memory.dmp

Filesize
1.0MB

Download
memory/2116-55-0x000000001C730000-0x000000001C832000-memory.dmp

Filesize
1.0MB

Download
memory/2116-1078-0x000007FEF5A63000-0x000007FEF5A64000-memory.dmp

Filesize
4KB

Download
memory/2116-53-0x000000001C730000-0x000000001C832000-memory.dmp

Filesize
1.0MB

Download
memory/2116-51-0x000000001C730000-0x000000001C832000-memory.dmp

Filesize
1.0MB

Download
memory/2116-49-0x000000001C730000-0x000000001C832000-memory.dmp

Filesize
1.0MB

Download
memory/2116-47-0x000000001C730000-0x000000001C832000-memory.dmp

Filesize
1.0MB

Download
memory/2116-1079-0x000007FEF5A60000-0x000007FEF644C000-memory.dmp

Filesize
9.9MB

Download
memory/2116-1080-0x000007FEF5A60000-0x000007FEF644C000-memory.dmp

Filesize
9.9MB

Download
memory/2116-1081-0x000000001ACC0000-0x000000001AD3A000-memory.dmp

Filesize
488KB

Download
memory/2116-1082-0x0000000000D90000-0x0000000000DDC000-memory.dmp

Filesize
304KB

Download
memory/2116-1083-0x000007FEF5A60000-0x000007FEF644C000-memory.dmp

Filesize
9.9MB

Download
memory/2116-1084-0x000007FEF5A60000-0x000007FEF644C000-memory.dmp

Filesize
9.9MB

Download
memory/2116-1085-0x000007FEF5A60000-0x000007FEF644C000-memory.dmp

Filesize
9.9MB

Download
memory/2116-1086-0x000007FEF5A60000-0x000007FEF644C000-memory.dmp

Filesize
9.9MB

Download
memory/2116-1087-0x00000000023D0000-0x0000000002424000-memory.dmp

Filesize
336KB

Download
memory/2116-1088-0x000007FEF5A60000-0x000007FEF644C000-memory.dmp

Filesize
9.9MB

Download