85ab9958e4dc3181a12de70b84ee73789083a374b687434edc9c8bc6cb4f8c2c | Triage

Analysis

max time kernel
23s
max time network
153s
platform
windows10_x64
resource
win10v20210410
submitted
16-07-2021 11:20

Sharing

Report Analysis Logs

General

Target

Twitch Monster/windows-chromium/90.0.4430.72/chrome_pwa_launcher.exe
Size

1.4MB
MD5

a320cdbfb82e1d5dc13d34a1669aeb2c
SHA1

b939e148f2994b06837c896506678f69cf47125d
SHA256

459b254849932230ceab95866c60fc0c988aa2f089c41721816be0cb7e031d61
SHA512

702958b2bd246e6c4625d14375eea4908d198f373bd74ec0cb660ca0f151c237913f450c6bc29a3182ec7c58edb01958575e26163fc62d5641e679fdaf037cc9

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1220 3368 WerFault.exe chrome_pwa_launcher.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
1220	WerFault.exe
1220	WerFault.exe
1220	WerFault.exe
1220	WerFault.exe
1220	WerFault.exe
1220	WerFault.exe
1220	WerFault.exe
1220	WerFault.exe
1220	WerFault.exe
1220	WerFault.exe
1220	WerFault.exe
1220	WerFault.exe
1220	WerFault.exe
1220	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1220 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Twitch Monster\windows-chromium\90.0.4430.72\chrome_pwa_launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Twitch Monster\windows-chromium\90.0.4430.72\chrome_pwa_launcher.exe"
1⤵
PID:3368

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3368 -s 468
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads