b40cfc8104637948490916cf1fef0230e833440f18b076b8faa965205d5e00a3 | Triage

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
12-05-2022 11:49

Sharing

Report Analysis Logs

General

Target

b40cfc8104637948490916cf1fef0230e833440f18b076b8faa965205d5e00a3.exe
Size

151KB
MD5

6283ab9805e50e9ea3a9a578ec514b6f
SHA1

7cd90278ae5a7de520e52049ad82edbc16b474fc
SHA256

b40cfc8104637948490916cf1fef0230e833440f18b076b8faa965205d5e00a3
SHA512

fe3e507dec4501997898daf06b5752cdb1630a1c310df050220a44dde8012c3b7f66a5de76d0dbe4503b05f4b71aae9d171eb2a32419851fc84300e7019f757d

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2956 1448 WerFault.exe b40cfc8104637948490916cf1fef0230e833440f18b076b8faa965205d5e00a3.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b40cfc8104637948490916cf1fef0230e833440f18b076b8faa965205d5e00a3.exe

description pid process

Token: SeDebugPrivilege 1448 b40cfc8104637948490916cf1fef0230e833440f18b076b8faa965205d5e00a3.exe

C:\Users\Admin\AppData\Local\Temp\b40cfc8104637948490916cf1fef0230e833440f18b076b8faa965205d5e00a3.exe
"C:\Users\Admin\AppData\Local\Temp\b40cfc8104637948490916cf1fef0230e833440f18b076b8faa965205d5e00a3.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 1440
2⤵
- Program crash
PID:2956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1448 -ip 1448
1⤵
PID:4836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1448-130-0x0000000000A50000-0x0000000000A7E000-memory.dmp

Filesize
184KB

Download