e25681e1fa9f84e578c0c54c9283bb819074fe45b3551e549363c1112cfa3fc4 | Triage

Analysis

max time kernel
117s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
31/10/2022, 11:41

Sharing

Report Analysis Logs

General

Target

#PO47947488-02-2022-BUY-REQUEST.exe
Size

17KB
MD5

932c6c73b43ea277f8038fcac487fece
SHA1

b151a024d9e78adca105c627ae53fd3343ef4469
SHA256

e25681e1fa9f84e578c0c54c9283bb819074fe45b3551e549363c1112cfa3fc4
SHA512

7db205d0435206cef2a324fa90e5de21db1d240367e9ab31fe7e91f5a20210135a06d10c51b62ca7197377abf17fcfc846d7d1de0f6b4ef91812cbff6cb2142c
SSDEEP

384:g1zC9ECor5d6ARZN/5oL3u6cBKHmrnMff3eE5Qf4:3orHgmrMX3ek

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4468	4616	WerFault.exe	79

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4616	#PO47947488-02-2022-BUY-REQUEST.exe

C:\Users\Admin\AppData\Local\Temp\#PO47947488-02-2022-BUY-REQUEST.exe
"C:\Users\Admin\AppData\Local\Temp\#PO47947488-02-2022-BUY-REQUEST.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4616
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 1516
  2⤵
  - Program crash
  PID:4468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4616 -ip 4616
1⤵
PID:216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4616-132-0x0000000000FB0000-0x0000000000FBA000-memory.dmp

Filesize
40KB

Download
memory/4616-133-0x0000000005E50000-0x00000000063F4000-memory.dmp

Filesize
5.6MB

Download
memory/4616-134-0x00000000058A0000-0x0000000005932000-memory.dmp

Filesize
584KB

Download
memory/4616-135-0x0000000005830000-0x000000000583A000-memory.dmp

Filesize
40KB

Download