53f330f7212a4e3fb1f942efa722231990af3c986a345d17a3dd451c8762314c | Triage™

Analysis

max time kernel
116s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
09/05/2022, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.W32.AIDetectNet.01.13850.exe
Size 22KB
Sample220509-e9yt5scda6
SHA256 53f330f7212a4e3fb1f942efa722231990af3c986a345d17a3dd451c8762314c
MD5 6c9017d94ebba76fa009a022cc47c6f1
SHA1 99dcfa1cfd7995057f018d8787411bda73a47940
SHA512 e78444d16e4be5b8a45cebfbf75fdcb3369d6a64b51934d42e9cca026802b0216594fa5772737f88b54afafa723d6fb44246c5890f29e4518510a3f0d398a390
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3728	668	WerFault.exe	80

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	668	SecuriteInfo.com.W32.AIDetectNet.01.13850.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.13850.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.13850.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:668
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 668 -s 1476
  2⤵
  - Program crash
  PID:3728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 668 -ip 668
1⤵
PID:2732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:4128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/668-130-0x0000000000560000-0x000000000056C000-memory.dmp

Download