7f401517937cd0fd1cc59c7e4d948ab31f9ba073d620e9c5a6f91f68bf7c19b2 | Triage

Analysis

max time kernel
193s
max time network
196s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
08-12-2022 19:42

Sharing

Report Analysis Logs

General

Target

RQT-0678051000.exe
Size

6KB
MD5

c15b6613a19f6f2bce456363f3df6e34
SHA1

ff5be9998a01db6a07125daa3e077e367c49189c
SHA256

f48c884a7b0e982a29ac2baf6d7b44bd706d37f087fabeb2477bf342772693ba
SHA512

c756905583832f7d1528adfb4fcbf14bf0a70f9514a33bfa7303e42beb4758370d58d844b706e951058db44f820e3bfaad28517d30455ec1c2d2fe3d895eb899
SSDEEP

96:SnHAHgz03fwboj5xpyaqLMxLutW/g8Kf4mksu2s3zNt:/HQSJL0aqLhtoXKf4Ls8h

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

224 4496 WerFault.exe RQT-0678051000.exe
2448 4496 WerFault.exe RQT-0678051000.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RQT-0678051000.exe

description pid process

Token: SeDebugPrivilege 4496 RQT-0678051000.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

RQT-0678051000.exe

description	pid	process	target process
PID 4496 wrote to memory of 224	4496	RQT-0678051000.exe	WerFault.exe
PID 4496 wrote to memory of 224	4496	RQT-0678051000.exe	WerFault.exe
PID 4496 wrote to memory of 224	4496	RQT-0678051000.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\RQT-0678051000.exe
"C:\Users\Admin\AppData\Local\Temp\RQT-0678051000.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 1360
  2⤵
  - Program crash
  PID:224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 1360
  2⤵
  - Program crash
  PID:2448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4496 -ip 4496
1⤵
PID:3768

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/224-133-0x0000000000000000-mapping.dmp

Download
memory/4496-132-0x0000000000290000-0x0000000000298000-memory.dmp

Filesize
32KB

Download