Analysis
- max time kernel
151s - max time network
190s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
20/05/2022, 13:30
General
- Target 837e883f7c3ea1265541c52b778208cf.exe
- Size 26KB
- Sample220520-qrs2qadhc8
- SHA256 f1a8c87268b34174fbffc2f410adeeb091629104ed587c8d6a6b413cef08b126
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\837e883f7c3ea1265541c52b778208cf.exe"C:\Users\Admin\AppData\Local\Temp\837e883f7c3ea1265541c52b778208cf.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 15842⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1916 -ip 19161⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1916-130-0x00000000008F0000-0x00000000008FC000-memory.dmp
memory/1916-131-0x0000000005890000-0x0000000005E34000-memory.dmp
memory/1916-132-0x0000000005380000-0x0000000005412000-memory.dmp
memory/1916-133-0x0000000005290000-0x000000000529A000-memory.dmp