Analysis
- max time kernel
145s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
08/06/2022, 05:59
General
- Target 26ed0fe0f7c70df9e9f1f37d26f79c5b.exe
- Size 133KB
- Sample220608-gprlfacdfm
- SHA256 15e2f966937440c34a383f8a2df6fa8b380fbc858b7560e3129f563296e17fbb
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\26ed0fe0f7c70df9e9f1f37d26f79c5b.exe"C:\Users\Admin\AppData\Local\Temp\26ed0fe0f7c70df9e9f1f37d26f79c5b.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1480 -s 13642⤵
- Program crash
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 360 -p 1480 -ip 14801⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1480-130-0x000002233F4A0000-0x000002233F4C4000-memory.dmp
memory/1480-131-0x00007FF8B73B0000-0x00007FF8B7E71000-memory.dmp
memory/1480-132-0x00007FF8B73B0000-0x00007FF8B7E71000-memory.dmp
memory/1480-133-0x00007FF8B73B0000-0x00007FF8B7E71000-memory.dmp