0f02256b8a15dd5c68fa8a2fcfa966285064e0a2fa651b01b335398ed03e180d | Triage

Analysis

max time kernel
92s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
04-06-2022 17:03

Sharing

Report Analysis Logs

General

Target

0f02256b8a15dd5c68fa8a2fcfa966285064e0a2fa651b01b335398ed03e180d.exe
Size

1.7MB
MD5

4740d75e1acce41b474cd2cb104690cd
SHA1

dddcd28617e72d7500694caeaecc7386a1db97e0
SHA256

0f02256b8a15dd5c68fa8a2fcfa966285064e0a2fa651b01b335398ed03e180d
SHA512

83d66ef41befb02c2d7bfd5755271296790039258205988d293a2162b34dc766264d807a86ba665c43dec25542e380c168a09af21dd161325ff711fceb2aa217

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1672 4652 WerFault.exe 0f02256b8a15dd5c68fa8a2fcfa966285064e0a2fa651b01b335398ed03e180d.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0f02256b8a15dd5c68fa8a2fcfa966285064e0a2fa651b01b335398ed03e180d.exe

description pid process

Token: SeDebugPrivilege 4652 0f02256b8a15dd5c68fa8a2fcfa966285064e0a2fa651b01b335398ed03e180d.exe

C:\Users\Admin\AppData\Local\Temp\0f02256b8a15dd5c68fa8a2fcfa966285064e0a2fa651b01b335398ed03e180d.exe
"C:\Users\Admin\AppData\Local\Temp\0f02256b8a15dd5c68fa8a2fcfa966285064e0a2fa651b01b335398ed03e180d.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 1696
2⤵
- Program crash
PID:1672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4652 -ip 4652
1⤵
PID:5036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4652-130-0x0000000000840000-0x00000000009F6000-memory.dmp

Filesize
1.7MB

Download
memory/4652-131-0x0000000005790000-0x00000000057F6000-memory.dmp

Filesize
408KB

Download