22253965d84bef16f8026c0e76c58313a3b2fb1ce2aca2bc5b7cbda1f35297c8 | Triage™

Analysis

max time kernel
141s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
24/04/2022, 14:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5d6692d802b1b86acb03a79fda0ecd52.exe
Size 781KB
Sample220424-rt5c7sdghp
SHA256 22253965d84bef16f8026c0e76c58313a3b2fb1ce2aca2bc5b7cbda1f35297c8
MD5 5d6692d802b1b86acb03a79fda0ecd52
SHA1 57b18e2991b333a79a10620c0d4fa73f589a3f5e
SHA512 f98cf7ec1ace9d0ad82a77d27228c03251fc76dc8284cdadd7b5b2e7f35476a57650171a848adc75c11a52c8e3824cc97d46bf7170a8f73d8c4887ccd68ace19
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Program crash 1 IoCs

pid	pid_target	Process	procid_target
676	3860	WerFault.exe	80

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3860	5d6692d802b1b86acb03a79fda0ecd52.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3860 wrote to memory of 2136	3860	5d6692d802b1b86acb03a79fda0ecd52.exe	81
PID 3860 wrote to memory of 2136	3860	5d6692d802b1b86acb03a79fda0ecd52.exe	81
PID 3860 wrote to memory of 2136	3860	5d6692d802b1b86acb03a79fda0ecd52.exe	81

C:\Users\Admin\AppData\Local\Temp\5d6692d802b1b86acb03a79fda0ecd52.exe
"C:\Users\Admin\AppData\Local\Temp\5d6692d802b1b86acb03a79fda0ecd52.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3860
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  PID:2136
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3860 -s 1420
  2⤵
  - Program crash
  PID:676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3860 -ip 3860
1⤵
PID:4076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3860-130-0x0000000000E50000-0x0000000000F1A000-memory.dmp

Download