caf6ed58c3953288f5a49df396b1585fe04c009afa866c9b10719c58f9102a28 | Triage

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12-01-2024 01:22

Sharing

Report Analysis Logs

General

Target

551a6df7df73e31291d6ffb29b4ad569.exe
Size

30KB
MD5

551a6df7df73e31291d6ffb29b4ad569
SHA1

d1627a1b72d160d5d2f4598000c3c717d9477e8d
SHA256

caf6ed58c3953288f5a49df396b1585fe04c009afa866c9b10719c58f9102a28
SHA512

7cda0e05e48a09a0fe9616eafdfb3a4f46f29914b2dc3f302a082221d4ad64f2a0cc914147d7853d27841242d263d037e31065fecca1777ecb3b953defb6e860
SSDEEP

768:KVYviHEsgK8unH+J569B8ZM7BPgVj1PfZh/Gf:KVYqke8uzwQB6Pxh+f

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3232	1572	WerFault.exe	81

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1572	551a6df7df73e31291d6ffb29b4ad569.exe

C:\Users\Admin\AppData\Local\Temp\551a6df7df73e31291d6ffb29b4ad569.exe
"C:\Users\Admin\AppData\Local\Temp\551a6df7df73e31291d6ffb29b4ad569.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1572
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 256
  2⤵
  - Program crash
  PID:3232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1572 -ip 1572
1⤵
PID:3820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1572-0-0x0000000008000000-0x000000000800C000-memory.dmp

Filesize
48KB

Download