1b7e034dcef7122ca791a5da14c588922d67cf81f33c6d1e281d54df46a11bc2 | Triage™

Analysis

max time kernel
78s
max time network
122s
platform
windows10_x64
resource
win10-en-20211208
submitted
08/01/2022, 07:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GenshinXYZ.exe
Size 3.4MB
Sample220108-hsnjmacgg2
SHA256 1b7e034dcef7122ca791a5da14c588922d67cf81f33c6d1e281d54df46a11bc2
MD5 e1573e67664715db6fe842de15b44ece
SHA1 a3b6fff6ce083594aaf50a540c56f0a251b459fc
SHA512 68300b98d7b6b04741efe707a815045daf095ffcb83fde624a19a235fbdcdb87bb8f56479d21341e84bfbe0cad4552cf892e9c6762487d743b1506aa29f2ab50
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2640	2648	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2640	WerFault.exe
2640	WerFault.exe
2640	WerFault.exe
2640	WerFault.exe
2640	WerFault.exe
2640	WerFault.exe
2640	WerFault.exe
2640	WerFault.exe
2640	WerFault.exe
2640	WerFault.exe
2640	WerFault.exe
2640	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2640	WerFault.exe
Token: SeBackupPrivilege	2640	WerFault.exe
Token: SeDebugPrivilege	2640	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\GenshinXYZ.exe
"C:\Users\Admin\AppData\Local\Temp\GenshinXYZ.exe"
1⤵
PID:2648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 404
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2648-115-0x0000000002710000-0x0000000002770000-memory.dmp

Download