43a8fe38ab8ff45d22935391ee2487608fb4d8efc9a0d7a3cef92e09c1395615 | Triage

Analysis

max time kernel
148s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2024, 09:39

Sharing

Report Analysis Logs

General

Target

45e777c57811644d3b4f2361935d47bd.exe
Size

460KB
MD5

45e777c57811644d3b4f2361935d47bd
SHA1

91d50074e2fae9baf5c7bcbc9c6b3a20c0f2a578
SHA256

43a8fe38ab8ff45d22935391ee2487608fb4d8efc9a0d7a3cef92e09c1395615
SHA512

f7ba4f92172d328b06c57d91bd71be3235d2bf8de34fed1e35f3930982359e991cf492e38732ab4af0fdde431bad0e5a2061756b79a6495e3e1dc3b165a0bc11
SSDEEP

6144:wvLpPV4I/w589NjIRmqZHF7S1M4IBprBnBsf/W2T6:wvLpPnNu7Sm400Z+

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4660	3664	WerFault.exe	14

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3664	45e777c57811644d3b4f2361935d47bd.exe

C:\Users\Admin\AppData\Local\Temp\45e777c57811644d3b4f2361935d47bd.exe
"C:\Users\Admin\AppData\Local\Temp\45e777c57811644d3b4f2361935d47bd.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 528
  2⤵
  - Program crash
  PID:4660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3664 -ip 3664
1⤵
PID:736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3664-0-0x0000000000720000-0x0000000000795000-memory.dmp

Filesize
468KB

Download
memory/3664-1-0x0000000000720000-0x0000000000795000-memory.dmp

Filesize
468KB

Download