59a0d948c0709a32b0c4752de34ba53fcaa3239b3c6519a51d8710c6f2bfaec5

Analysis

max time kernel
141s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
12-09-2023 16:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2408-0-0x0000000000400000-0x000000000043D000-memory.exe
Size

244KB
MD5

b014f2f77e1504773aa4a9d9fa28ea36
SHA1

06485cd34643638988d7b38a2cd911e6e0cf5fca
SHA256

59a0d948c0709a32b0c4752de34ba53fcaa3239b3c6519a51d8710c6f2bfaec5
SHA512

a915f9b56d567b30bb0be5436d351197e8d397d9f858fb696f61418049de270d0ead9a919f7f475e5e6586933bd2d66338683d174c2a4b724bcc78662e252bf3
SSDEEP

1536:UYz/E8hW9NdYAygNlvhIoOB9SAKD7PNch1ZmmImh1ADN8blGe5SagvHLNaV8VJ3n:Um/E8k9ZjpIn+zNch12KbAwSaSdJSp8

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1896 5000 WerFault.exe 2408-0-0x0000000000400000-0x000000000043D000-memory.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeManageVolumePrivilege 1788 svchost.exe

pid	pid_target	process	target process
1896	5000	WerFault.exe	2408-0-0x0000000000400000-0x000000000043D000-memory.exe

description	pid	process
Token: SeManageVolumePrivilege	1788	svchost.exe

C:\Users\Admin\AppData\Local\Temp\2408-0-0x0000000000400000-0x000000000043D000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\2408-0-0x0000000000400000-0x000000000043D000-memory.exe"
1⤵
PID:5000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 216
2⤵
- Program crash
PID:1896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5000 -ip 5000
1⤵
PID:64

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:3364

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm
Filesize
16KB

MD5
1ba703d4231291b09ccf68135eed4e7e

SHA1
3c9d6bdb31672fcc6d2fba2bfcd5ecef3be0fba3

SHA256
06fcafeb1b6b4064296be1f4924b6062c5fd92d4ef1cef318f1cad4890b6a047

SHA512
00c0466818b35adc7364a622229c10da702595dc9af4fd4998b515ee739b270785064bbd3630e7917c151287573180afbae90d5488ba0f660226b2c70d27c5e1

Download Submit
memory/1788-42-0x000001B8607A0000-0x000001B8607A1000-memory.dmp

Filesize
4KB

Download
memory/1788-69-0x000001B860610000-0x000001B860611000-memory.dmp

Filesize
4KB

Download
memory/1788-41-0x000001B8607A0000-0x000001B8607A1000-memory.dmp

Filesize
4KB

Download
memory/1788-34-0x000001B8607A0000-0x000001B8607A1000-memory.dmp

Filesize
4KB

Download
memory/1788-35-0x000001B8607A0000-0x000001B8607A1000-memory.dmp

Filesize
4KB

Download
memory/1788-36-0x000001B8607A0000-0x000001B8607A1000-memory.dmp

Filesize
4KB

Download
memory/1788-37-0x000001B8607A0000-0x000001B8607A1000-memory.dmp

Filesize
4KB

Download
memory/1788-38-0x000001B8607A0000-0x000001B8607A1000-memory.dmp

Filesize
4KB

Download
memory/1788-39-0x000001B8607A0000-0x000001B8607A1000-memory.dmp

Filesize
4KB

Download
memory/1788-43-0x000001B8607A0000-0x000001B8607A1000-memory.dmp

Filesize
4KB

Download
memory/1788-33-0x000001B860770000-0x000001B860771000-memory.dmp

Filesize
4KB

Download
memory/1788-17-0x000001B858180000-0x000001B858190000-memory.dmp

Filesize
64KB

Download
memory/1788-40-0x000001B8607A0000-0x000001B8607A1000-memory.dmp

Filesize
4KB

Download
memory/1788-44-0x000001B8603C0000-0x000001B8603C1000-memory.dmp

Filesize
4KB

Download
memory/1788-45-0x000001B8603B0000-0x000001B8603B1000-memory.dmp

Filesize
4KB

Download
memory/1788-47-0x000001B8603C0000-0x000001B8603C1000-memory.dmp

Filesize
4KB

Download
memory/1788-50-0x000001B8603B0000-0x000001B8603B1000-memory.dmp

Filesize
4KB

Download
memory/1788-53-0x000001B8602F0000-0x000001B8602F1000-memory.dmp

Filesize
4KB

Download
memory/1788-1-0x000001B858080000-0x000001B858090000-memory.dmp

Filesize
64KB

Download
memory/1788-65-0x000001B8604F0000-0x000001B8604F1000-memory.dmp

Filesize
4KB

Download
memory/1788-67-0x000001B860500000-0x000001B860501000-memory.dmp

Filesize
4KB

Download
memory/1788-68-0x000001B860500000-0x000001B860501000-memory.dmp

Filesize
4KB

Download
memory/5000-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads