eb205a5851de3d6f7fbce5129dea8443bffcac19ae1436e88e8e0ea4bc5d1585 | Triage

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
08-02-2023 19:08

Sharing

Report Analysis Logs

General

Target

6c701b09803ad18e93024d320c6a324d.exe
Size

29KB
MD5

6c701b09803ad18e93024d320c6a324d
SHA1

da096644b61ab6c6dc5544733794773a141c4b17
SHA256

eb205a5851de3d6f7fbce5129dea8443bffcac19ae1436e88e8e0ea4bc5d1585
SHA512

95dd75fd729aa684e14fa1e5568bb2ab3d3f730f0f0b34215ceb5a2f847dd202373358877450940ced7a074856fcfcb1242120d70b1cf38cd5082c2a94ce175c
SSDEEP

768:N2vFNP/2hkbIz0RhijkXSiegJAY93sP7nwXr:eFN3YTiegS03sDw7

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2856 2212 WerFault.exe 6c701b09803ad18e93024d320c6a324d.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

6c701b09803ad18e93024d320c6a324d.exe

description pid process

Token: SeDebugPrivilege 2212 6c701b09803ad18e93024d320c6a324d.exe

C:\Users\Admin\AppData\Local\Temp\6c701b09803ad18e93024d320c6a324d.exe
"C:\Users\Admin\AppData\Local\Temp\6c701b09803ad18e93024d320c6a324d.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 1500
2⤵
- Program crash
PID:2856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2212 -ip 2212
1⤵
PID:1788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2212-132-0x0000000000D50000-0x0000000000D5C000-memory.dmp

Filesize
48KB

Download
memory/2212-133-0x0000000005C70000-0x0000000006214000-memory.dmp

Filesize
5.6MB

Download
memory/2212-134-0x00000000055D0000-0x0000000005662000-memory.dmp

Filesize
584KB

Download