ce67dd2cbfbc22d1ee45c2429da775036c0894f72021df6ab0eb849e96e29daf | Triage

Analysis

max time kernel
90s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
21-06-2022 11:08

Sharing

Report Analysis Logs

General

Target

fa78ece109e579e23450df0e22125016.exe
Size

62KB
MD5

fa78ece109e579e23450df0e22125016
SHA1

f8a67ae477d06f287c1186fae9e8c5e51ca2f751
SHA256

ce67dd2cbfbc22d1ee45c2429da775036c0894f72021df6ab0eb849e96e29daf
SHA512

1b20859efaa4eac89b405873fac634839c5b9ade6d2aa53c7b329ae5d1b8b1da9eccc4f1411ccfff82c24347697dc1ea46c24f88a9da2f69c14b90bab5882522

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3164	1960	WerFault.exe	78

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1960	fa78ece109e579e23450df0e22125016.exe

C:\Users\Admin\AppData\Local\Temp\fa78ece109e579e23450df0e22125016.exe
"C:\Users\Admin\AppData\Local\Temp\fa78ece109e579e23450df0e22125016.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 1792
  2⤵
  - Program crash
  PID:3164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1960 -ip 1960
1⤵
PID:1740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1960-130-0x00000000003E0000-0x00000000003F6000-memory.dmp

Filesize
88KB

Download
memory/1960-131-0x00000000052D0000-0x0000000005874000-memory.dmp

Filesize
5.6MB

Download
memory/1960-132-0x0000000004DA0000-0x0000000004E16000-memory.dmp

Filesize
472KB

Download