Analysis
-
max time kernel
1560s -
max time network
1560s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29-06-2024 05:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
WaveInstaller (1).exe
Resource
win7-20240221-en
3 signatures
1800 seconds
Behavioral task
behavioral2
Sample
WaveInstaller (1).exe
Resource
win10v2004-20240508-en
33 signatures
1800 seconds
General
-
Target
WaveInstaller (1).exe
-
Size
1.5MB
-
MD5
b075f4320e46d0d5e78a649e8ee011cc
-
SHA1
b0dd50171323f0f83dbea0340e9ed8cf44bea38e
-
SHA256
8581823244a50bbed9709d09f3eba29dd9989681d96bff2b6c19245053069feb
-
SHA512
e08024b5fa50dc344ca18413a6c21e0f20490c22c90c565d6f663014f1673643da1d5d748e0cefca8a7cbae91a62470289803ad588d3aa5cf3dc6292d7393d47
-
SSDEEP
24576:VviinbT3ipyqwPx4x3RyFoBkkAd04wJAAh/jV1gJcPNZI6fntX3HOt2pq081ind2:MinbT3ipTD0anywJAaD/3U2pqjindT
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2516 2172 WerFault.exe WaveInstaller (1).exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WaveInstaller (1).exedescription pid process Token: SeDebugPrivilege 2172 WaveInstaller (1).exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
WaveInstaller (1).exedescription pid process target process PID 2172 wrote to memory of 2516 2172 WaveInstaller (1).exe WerFault.exe PID 2172 wrote to memory of 2516 2172 WaveInstaller (1).exe WerFault.exe PID 2172 wrote to memory of 2516 2172 WaveInstaller (1).exe WerFault.exe PID 2172 wrote to memory of 2516 2172 WaveInstaller (1).exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\WaveInstaller (1).exe"C:\Users\Admin\AppData\Local\Temp\WaveInstaller (1).exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 15642⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2172-0-0x000000007469E000-0x000000007469F000-memory.dmpFilesize
4KB
-
memory/2172-1-0x0000000000D80000-0x0000000000F12000-memory.dmpFilesize
1.6MB
-
memory/2172-2-0x0000000074690000-0x0000000074D7E000-memory.dmpFilesize
6.9MB
-
memory/2172-4-0x00000000003A0000-0x00000000003AA000-memory.dmpFilesize
40KB
-
memory/2172-3-0x00000000003A0000-0x00000000003AA000-memory.dmpFilesize
40KB
-
memory/2172-5-0x0000000074690000-0x0000000074D7E000-memory.dmpFilesize
6.9MB
-
memory/2172-6-0x0000000074690000-0x0000000074D7E000-memory.dmpFilesize
6.9MB
-
memory/2172-7-0x000000007469E000-0x000000007469F000-memory.dmpFilesize
4KB
-
memory/2172-8-0x0000000074690000-0x0000000074D7E000-memory.dmpFilesize
6.9MB
-
memory/2172-10-0x00000000003A0000-0x00000000003AA000-memory.dmpFilesize
40KB
-
memory/2172-9-0x00000000003A0000-0x00000000003AA000-memory.dmpFilesize
40KB
-
memory/2172-11-0x0000000074690000-0x0000000074D7E000-memory.dmpFilesize
6.9MB
-
memory/2172-12-0x0000000074690000-0x0000000074D7E000-memory.dmpFilesize
6.9MB