Analysis
- max time kernel
125s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
- submitted
07/10/2023, 04:03
General
- Target 5399d7a2060eca17c4c1648fd6b09505.exe
- Size 778KB
- Sample231007-emc9xshb2w
- SHA256 3751dae5d0813f6ec2fcc253c65854ddad340be058b199f4eb0a540bbf878efe
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5399d7a2060eca17c4c1648fd6b09505.exe"C:\Users\Admin\AppData\Local\Temp\5399d7a2060eca17c4c1648fd6b09505.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 17282⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4600 -ip 46001⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4600-0-0x0000000000710000-0x00000000007D8000-memory.dmp
memory/4600-1-0x0000000074940000-0x00000000750F0000-memory.dmp
memory/4600-2-0x0000000002AC0000-0x0000000002AD0000-memory.dmp
memory/4600-3-0x0000000002A30000-0x0000000002A38000-memory.dmp
memory/4600-4-0x00000000061A0000-0x00000000061DC000-memory.dmp
memory/4600-5-0x0000000006200000-0x000000000622C000-memory.dmp
memory/4600-6-0x00000000062B0000-0x00000000062FC000-memory.dmp
memory/4600-7-0x0000000006910000-0x0000000006EB4000-memory.dmp
memory/4600-8-0x0000000074940000-0x00000000750F0000-memory.dmp