Analysis

  • max time kernel
    194s
  • max time network
    206s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    20/05/2022, 18:48

General

  • Target

    f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901.exe

  • Size

    598KB

  • MD5

    4872dfbfd5180fb118d93b9a786d1eb0

  • SHA1

    0d42a59ef21ec45a8317d828111ab49beea8b312

  • SHA256

    f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901

  • SHA512

    b8887871ec530484e77e16af1afd10599f8df9cdca63af0fd14f5b1e730d30d3e4790bd15fcd46f8b014bc4e5452be72819993bfa336d9e09ae2f283c69b4ae2

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901.exe
    "C:\Users\Admin\AppData\Local\Temp\f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2124
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 8876
      2⤵
      • Program crash
      PID:4420
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2124 -ip 2124
    1⤵
      PID:4452

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/2124-130-0x0000000000800000-0x000000000089C000-memory.dmp

            Filesize

            624KB

          • memory/2124-131-0x0000000002C50000-0x0000000002C53000-memory.dmp

            Filesize

            12KB