f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901 | Triage™

Analysis

max time kernel
194s
max time network
206s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
20/05/2022, 18:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901.exe
Size 598KB
Sample220520-xf2m2sfdcj
SHA256 f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901
MD5 4872dfbfd5180fb118d93b9a786d1eb0
SHA1 0d42a59ef21ec45a8317d828111ab49beea8b312
SHA512 b8887871ec530484e77e16af1afd10599f8df9cdca63af0fd14f5b1e730d30d3e4790bd15fcd46f8b014bc4e5452be72819993bfa336d9e09ae2f283c69b4ae2
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4420	2124	WerFault.exe	80

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2124	f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901.exe

C:\Users\Admin\AppData\Local\Temp\f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901.exe
"C:\Users\Admin\AppData\Local\Temp\f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2124
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 8876
  2⤵
  - Program crash
  PID:4420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2124 -ip 2124
1⤵
PID:4452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2124-130-0x0000000000800000-0x000000000089C000-memory.dmp

Download

memory/2124-131-0x0000000002C50000-0x0000000002C53000-memory.dmp

Download