31d0c756511a92e103d90c39fe935fc3f05bcd877de79cdf3a65ca008d91dfdf | Triage™

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
10/05/2022, 05:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
854F1E97-5DBB-4A87-A566-33D9012B05E2.exe
Size 95KB
Sample220510-gj57msfec6
SHA256 31d0c756511a92e103d90c39fe935fc3f05bcd877de79cdf3a65ca008d91dfdf
MD5 32769875ba094649f97b67a2a2ca0fa8
SHA1 a5d553aee74e4f8ff9df5d240f6b00b6b2423f61
SHA512 894a12cee23975a9d143b55da98be0dcc469ab6b9e59e18a8cd2ce6531afc02479c823de7a467f163e2c6f5a3fbd5d6cc001f6b4754b1a299ed95f0beba46bde
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2012	3924	WerFault.exe	80

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3924	854F1E97-5DBB-4A87-A566-33D9012B05E2.exe

C:\Users\Admin\AppData\Local\Temp\854F1E97-5DBB-4A87-A566-33D9012B05E2.exe
"C:\Users\Admin\AppData\Local\Temp\854F1E97-5DBB-4A87-A566-33D9012B05E2.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 1736
  2⤵
  - Program crash
  PID:2012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 3924 -ip 3924
1⤵
PID:4532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3924-130-0x0000000000BB0000-0x0000000000BCE000-memory.dmp

Download