213fce24e326925749adebaff2d85e23bba2b616c872e2089b23fa231f18756e | Triage

Analysis

max time kernel
120s
max time network
127s
platform
windows10_x64
resource
win10-en-20211208
submitted
29-12-2021 07:50

Sharing

Report Analysis Logs

General

Target

OfficialKiddionsModMenuV0.8.7.exe
Size

4.2MB
MD5

7de3896baf12500f3e1cd311e2340806
SHA1

500b906981aaa4810848643f1d8c17efa87bad20
SHA256

213fce24e326925749adebaff2d85e23bba2b616c872e2089b23fa231f18756e
SHA512

d08cf4dcb3170f4654ef7121078b2c902285732dc3b2292d1a1e9d576f639050c98c08e8d1391b1bfa46f313bb9b8840968b86077d5e52f49e882994f13abef1

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3820 3440 WerFault.exe OfficialKiddionsModMenuV0.8.7.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
3820	WerFault.exe
3820	WerFault.exe
3820	WerFault.exe
3820	WerFault.exe
3820	WerFault.exe
3820	WerFault.exe
3820	WerFault.exe
3820	WerFault.exe
3820	WerFault.exe
3820	WerFault.exe
3820	WerFault.exe
3820	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3820 WerFault.exe
Token: SeBackupPrivilege 3820 WerFault.exe
Token: SeDebugPrivilege 3820 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\OfficialKiddionsModMenuV0.8.7.exe
"C:\Users\Admin\AppData\Local\Temp\OfficialKiddionsModMenuV0.8.7.exe"
1⤵
PID:3440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 404
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3440-115-0x0000000002770000-0x00000000027D0000-memory.dmp

Filesize
384KB

Download