hxxps://click[.]snapchat[.]com/aVHG?pid=apchat_download_page&af_web_dp=[//]rclinic[.]ir/cp/0AYFK8/stefan[.]holzberger@ambest[.]com

Resubmissions

30-11-2022 15:51

30-11-2022 15:48

max time kernel
151s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 15:51

Target

https://click.snapchat.com/aVHG?pid=apchat_download_page&af_web_dp=//rclinic.ir/cp/0AYFK8/stefan.holzberger@ambest.com

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1192 4868 WerFault.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

4832 powershell.exe
4832 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 4832 powershell.exe

pid	pid_target	process	target process
1192	4868	WerFault.exe

pid	process
4832	powershell.exe
4832	powershell.exe

description	pid	process
Token: SeDebugPrivilege	4832	powershell.exe

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 472 -p 4868 -ip 4868
1⤵
PID:4596

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4868 -s 840
1⤵
- Program crash
PID:1192

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n /f "C:\Users\Admin\Desktop\ConnectOpen.dot"
1⤵
PID:5096

memory/4832-132-0x000001A9DAA60000-0x000001A9DAA82000-memory.dmp

Filesize
136KB

Download
memory/4832-133-0x00007FFFDEF20000-0x00007FFFDF9E1000-memory.dmp

Filesize
10.8MB

Download
memory/4832-134-0x00007FFFDEF20000-0x00007FFFDF9E1000-memory.dmp

Filesize
10.8MB

Download
memory/5096-135-0x00007FFFBD930000-0x00007FFFBD940000-memory.dmp

Filesize
64KB

Download
memory/5096-136-0x00007FFFBD930000-0x00007FFFBD940000-memory.dmp

Filesize
64KB

Download
memory/5096-137-0x00007FFFBD930000-0x00007FFFBD940000-memory.dmp

Filesize
64KB

Download
memory/5096-138-0x00007FFFBD930000-0x00007FFFBD940000-memory.dmp

Filesize
64KB

Download
memory/5096-139-0x00007FFFBD930000-0x00007FFFBD940000-memory.dmp

Filesize
64KB

Download
memory/5096-140-0x00007FFFBB660000-0x00007FFFBB670000-memory.dmp

Filesize
64KB

Download