b40cfc8104637948490916cf1fef0230e833440f18b076b8faa965205d5e00a3 | Triage™

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
12/05/2022, 11:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b40cfc8104637948490916cf1fef0230e833440f18b076b8faa965205d5e00a3.exe
Size 151KB
Sample220512-nzh6dadcg7
SHA256 b40cfc8104637948490916cf1fef0230e833440f18b076b8faa965205d5e00a3
MD5 6283ab9805e50e9ea3a9a578ec514b6f
SHA1 7cd90278ae5a7de520e52049ad82edbc16b474fc
SHA512 fe3e507dec4501997898daf06b5752cdb1630a1c310df050220a44dde8012c3b7f66a5de76d0dbe4503b05f4b71aae9d171eb2a32419851fc84300e7019f757d
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2956	1448	WerFault.exe	81

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1448	b40cfc8104637948490916cf1fef0230e833440f18b076b8faa965205d5e00a3.exe

C:\Users\Admin\AppData\Local\Temp\b40cfc8104637948490916cf1fef0230e833440f18b076b8faa965205d5e00a3.exe
"C:\Users\Admin\AppData\Local\Temp\b40cfc8104637948490916cf1fef0230e833440f18b076b8faa965205d5e00a3.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1448
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 1440
  2⤵
  - Program crash
  PID:2956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1448 -ip 1448
1⤵
PID:4836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1448-130-0x0000000000A50000-0x0000000000A7E000-memory.dmp

Download