1690bbc2db125ac7437afc46cf13e9b5ded50bc765cac50126d5ae2af73a3021 | Triage

Analysis

max time kernel
131s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 12:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c789df324a4aefdf2d43596260bafd03.exe
Size

30KB
MD5

c789df324a4aefdf2d43596260bafd03
SHA1

732b6bcd0a2a6d03be9c7f98db1abdf3d4bc8a39
SHA256

b6daeab59912633035a4fe359922f96d7445b55f87f3edba521d911deabfe658
SHA512

6d53710be0fea38b48c95745c840e9a85e68fa3c99c263c570ca8b0933d6ae317cb597cf469879ab26330fdd1667c4c14e49ce9c087b513d821f64adfac910fe
SSDEEP

768:qwYviH5v8qbJ+M569B8ZMABPgVj1PfZ9/J:qwYqZ0HwDB6Px9x

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1640	1480	WerFault.exe	82

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1480	c789df324a4aefdf2d43596260bafd03.exe

C:\Users\Admin\AppData\Local\Temp\c789df324a4aefdf2d43596260bafd03.exe
"C:\Users\Admin\AppData\Local\Temp\c789df324a4aefdf2d43596260bafd03.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 248
  2⤵
  - Program crash
  PID:1640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1480 -ip 1480
1⤵
PID:3100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1480-0-0x0000000008000000-0x000000000800C000-memory.dmp

Filesize
48KB

Download