f43dc24a6067339b69d032441ce7e2632e1770361dc33708de46cff9de25475b | Triage

Analysis

max time kernel
125s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2023, 21:12

Sharing

Report Analysis Logs

General

Target

a.exe
Size

359KB
MD5

f55698d82be20d245e141a8f7c19928e
SHA1

45c6a6475d7894b637cf9c74c9227b976db18f24
SHA256

f43dc24a6067339b69d032441ce7e2632e1770361dc33708de46cff9de25475b
SHA512

e95f681e2bc62ddc6fd98f5e429029e10571828a82814dfd819543ca475fe4d54d2e84cf3902a26052d97b13f0a3c88fcfa2df65b6c29223af0fd57aa34577c6
SSDEEP

6144:lQOZ6ys9QMtTHR0FNaXOyMDw+Nc8ntC+ygTRFqOA:l9Z/MtTHR0yXOyMMUfncE7G

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
536	644	WerFault.exe	84

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	644	a.exe

C:\Users\Admin\AppData\Local\Temp\a.exe
"C:\Users\Admin\AppData\Local\Temp\a.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:644
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 644 -s 1604
  2⤵
  - Program crash
  PID:536

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 644 -ip 644
1⤵
PID:3032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/644-133-0x00000297D0AB0000-0x00000297D0B0E000-memory.dmp

Filesize
376KB

Download
memory/644-134-0x00000297D0E90000-0x00000297D0EA0000-memory.dmp

Filesize
64KB

Download