Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29-11-2024 03:27
Static task
static1
Behavioral task
behavioral1
Sample
6c1748ec0692f3a7fff9fe45083a5267dc700a8384581b0303a52904f6995013.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
6c1748ec0692f3a7fff9fe45083a5267dc700a8384581b0303a52904f6995013.exe
Resource
win10v2004-20241007-en
General
-
Target
6c1748ec0692f3a7fff9fe45083a5267dc700a8384581b0303a52904f6995013.exe
-
Size
1.6MB
-
MD5
85353cd58ce1fd6aeb033dbaa95fe17d
-
SHA1
c18eaee8cdea9607491ae77e722d0976dcdfc079
-
SHA256
6c1748ec0692f3a7fff9fe45083a5267dc700a8384581b0303a52904f6995013
-
SHA512
b1d1ad7158849e4d03c18d0f10c4a7fc2fe9ad4c4542eec5002cc04b8b77697eaefe11df2dc2bec547eb217d38510447fd452728c4465821e9df547d00d588dd
-
SSDEEP
24576:ysAAc5cDkdFvoccVq+jCADs3jaUSyjzBpLtMfAOa6HXY04H444l:3A3wkHvocoq0CO8eu/TOLasY04H444l
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2140 6c1748ec0692f3a7fff9fe45083a5267dc700a8384581b0303a52904f6995013.exe 2140 6c1748ec0692f3a7fff9fe45083a5267dc700a8384581b0303a52904f6995013.exe 2140 6c1748ec0692f3a7fff9fe45083a5267dc700a8384581b0303a52904f6995013.exe 2140 6c1748ec0692f3a7fff9fe45083a5267dc700a8384581b0303a52904f6995013.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2140 6c1748ec0692f3a7fff9fe45083a5267dc700a8384581b0303a52904f6995013.exe Token: SeDebugPrivilege 2140 6c1748ec0692f3a7fff9fe45083a5267dc700a8384581b0303a52904f6995013.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2140 wrote to memory of 5084 2140 6c1748ec0692f3a7fff9fe45083a5267dc700a8384581b0303a52904f6995013.exe 32 PID 2140 wrote to memory of 5084 2140 6c1748ec0692f3a7fff9fe45083a5267dc700a8384581b0303a52904f6995013.exe 32 PID 2140 wrote to memory of 5084 2140 6c1748ec0692f3a7fff9fe45083a5267dc700a8384581b0303a52904f6995013.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c1748ec0692f3a7fff9fe45083a5267dc700a8384581b0303a52904f6995013.exe"C:\Users\Admin\AppData\Local\Temp\6c1748ec0692f3a7fff9fe45083a5267dc700a8384581b0303a52904f6995013.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2140 -s 7442⤵PID:5084
-