463839def6d60788a92ecd43af8d3f4a421d658059c6d8226bc12e02f76101e1 | Triage

Analysis

max time kernel
154s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
12-05-2022 11:50

Sharing

Report Analysis Logs

General

Target

463839def6d60788a92ecd43af8d3f4a421d658059c6d8226bc12e02f76101e1.exe
Size

141KB
MD5

7c22531ea58fe480003d63a5cf8a1430
SHA1

76f979c71a75e20d6f8f316126e3badb17b33b20
SHA256

463839def6d60788a92ecd43af8d3f4a421d658059c6d8226bc12e02f76101e1
SHA512

6d2355984fd2d3dac55ade9e7c8436fc71a5b293295b21b01d83433d091eb0dcf08d06015fa85912cb7e8bce8bf7ee1c328ac71205f7d638f4b43d9fd19f39b2

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1072 2856 WerFault.exe 463839def6d60788a92ecd43af8d3f4a421d658059c6d8226bc12e02f76101e1.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

463839def6d60788a92ecd43af8d3f4a421d658059c6d8226bc12e02f76101e1.exe

description pid process

Token: SeDebugPrivilege 2856 463839def6d60788a92ecd43af8d3f4a421d658059c6d8226bc12e02f76101e1.exe

C:\Users\Admin\AppData\Local\Temp\463839def6d60788a92ecd43af8d3f4a421d658059c6d8226bc12e02f76101e1.exe
"C:\Users\Admin\AppData\Local\Temp\463839def6d60788a92ecd43af8d3f4a421d658059c6d8226bc12e02f76101e1.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 1456
2⤵
- Program crash
PID:1072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2856 -ip 2856
1⤵
PID:2036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2856-131-0x0000000000D70000-0x0000000000D9C000-memory.dmp

Filesize
176KB

Download