a16e7379dfd435c1b99183299ecbdb3b468e47cc68bb9a14bef5fda17bb2e942 | Triage™

Analysis

max time kernel
122s
max time network
124s
platform
windows10_x64
resource
win10-en-20211208
submitted
07/01/2022, 00:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
flstudio_win_20.8.3.2304.exe
Size 3.5MB
Sample220107-adrnqsbfh3
SHA256 a16e7379dfd435c1b99183299ecbdb3b468e47cc68bb9a14bef5fda17bb2e942
MD5 12b09d900c949cb65821454f35c28135
SHA1 0e513d79b3d75c3e68eb75ee7ab43ea752b6c547
SHA512 3db8c951356ac2d55dc3b6756df644aaee257391286da52a18aaebdf8b5e5aa8a2366a205f98e30985e7c725d357ff379b3cc92cedd19aa893aeac932f5620c1
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3160	2740	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
3160	WerFault.exe
3160	WerFault.exe
3160	WerFault.exe
3160	WerFault.exe
3160	WerFault.exe
3160	WerFault.exe
3160	WerFault.exe
3160	WerFault.exe
3160	WerFault.exe
3160	WerFault.exe
3160	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3160	WerFault.exe
Token: SeBackupPrivilege	3160	WerFault.exe
Token: SeDebugPrivilege	3160	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\flstudio_win_20.8.3.2304.exe
"C:\Users\Admin\AppData\Local\Temp\flstudio_win_20.8.3.2304.exe"
1⤵
PID:2740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 404
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2740-115-0x0000000002760000-0x00000000027C0000-memory.dmp

Download