Analysis
-
max time kernel
194s -
max time network
206s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20/05/2022, 18:48
Static task
static1
Behavioral task
behavioral1
Sample
f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901.exe
Resource
win7-20220414-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901.exe
Resource
win10v2004-20220414-en
0 signatures
0 seconds
General
-
Target
f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901.exe
-
Size
598KB
-
MD5
4872dfbfd5180fb118d93b9a786d1eb0
-
SHA1
0d42a59ef21ec45a8317d828111ab49beea8b312
-
SHA256
f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901
-
SHA512
b8887871ec530484e77e16af1afd10599f8df9cdca63af0fd14f5b1e730d30d3e4790bd15fcd46f8b014bc4e5452be72819993bfa336d9e09ae2f283c69b4ae2
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4420 2124 WerFault.exe 80 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2124 f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901.exe"C:\Users\Admin\AppData\Local\Temp\f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2124 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 88762⤵
- Program crash
PID:4420
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2124 -ip 21241⤵PID:4452