Analysis
- max time kernel
66s - max time network
133s - platform
windows10_x64 - resource
win10v20201028 - submitted
06/11/2020, 10:49
Static task
static1
Behavioral task
behavioral1
Sample
cebd48d8e9131c2de3e41c0eb028bf8cd8ce92de9df01443d1d24c217645b511.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
cebd48d8e9131c2de3e41c0eb028bf8cd8ce92de9df01443d1d24c217645b511.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target cebd48d8e9131c2de3e41c0eb028bf8cd8ce92de9df01443d1d24c217645b511.exe
- Size 681KB
- Sample201106-e8an6sc7yx
- SHA256 cebd48d8e9131c2de3e41c0eb028bf8cd8ce92de9df01443d1d24c217645b511
- MD5 7e55f8a4dca5fe9ed6757a91b9ec4bdf
- SHA1 c22c87d35b9ca63cc348a24e29c4e69f12ecdb27
- SHA512 e8e5784df5ee64fb475a30fd8fd4b40cd2d01efb8bab43aa51d846065c5f8a3ff98988d622d2931e60f9dbc3099710c13e25f81caed5c83d30675124fdd3c332
- MD5 SHA1 SHA512
Score
3/10
Malware Config
Signatures
- Program crash 13 IoCs
pid pid_target Process procid_target 3136 980 WerFault.exe 67 2880 980 WerFault.exe 67 3676 980 WerFault.exe 67 2972 980 WerFault.exe 67 3952 980 WerFault.exe 67 2884 980 WerFault.exe 67 3580 980 WerFault.exe 67 2376 980 WerFault.exe 67 3044 980 WerFault.exe 67 1872 980 WerFault.exe 67 2960 980 WerFault.exe 67 1656 980 WerFault.exe 67 3956 980 WerFault.exe 67 - Suspicious behavior: EnumeratesProcesses 188 IoCs
pid Process 3136 WerFault.exe 3136 WerFault.exe 3136 WerFault.exe 3136 WerFault.exe 3136 WerFault.exe 3136 WerFault.exe 3136 WerFault.exe 3136 WerFault.exe 3136 WerFault.exe 3136 WerFault.exe 3136 WerFault.exe 3136 WerFault.exe 3136 WerFault.exe 3136 WerFault.exe 2880 WerFault.exe 2880 WerFault.exe 2880 WerFault.exe 2880 WerFault.exe 2880 WerFault.exe 2880 WerFault.exe 2880 WerFault.exe 2880 WerFault.exe 2880 WerFault.exe 2880 WerFault.exe 2880 WerFault.exe 2880 WerFault.exe 2880 WerFault.exe 2880 WerFault.exe 3676 WerFault.exe 3676 WerFault.exe 3676 WerFault.exe 3676 WerFault.exe 3676 WerFault.exe 3676 WerFault.exe 3676 WerFault.exe 3676 WerFault.exe 3676 WerFault.exe 3676 WerFault.exe 3676 WerFault.exe 3676 WerFault.exe 3676 WerFault.exe 3676 WerFault.exe 2972 WerFault.exe 2972 WerFault.exe 2972 WerFault.exe 2972 WerFault.exe 2972 WerFault.exe 2972 WerFault.exe 2972 WerFault.exe 2972 WerFault.exe 2972 WerFault.exe 2972 WerFault.exe 2972 WerFault.exe 2972 WerFault.exe 2972 WerFault.exe 2972 WerFault.exe 3952 WerFault.exe 3952 WerFault.exe 3952 WerFault.exe 3952 WerFault.exe 3952 WerFault.exe 3952 WerFault.exe 3952 WerFault.exe 3952 WerFault.exe 3952 WerFault.exe 3952 WerFault.exe 3952 WerFault.exe 3952 WerFault.exe 3952 WerFault.exe 3952 WerFault.exe 2884 WerFault.exe 2884 WerFault.exe 2884 WerFault.exe 2884 WerFault.exe 2884 WerFault.exe 2884 WerFault.exe 2884 WerFault.exe 2884 WerFault.exe 2884 WerFault.exe 2884 WerFault.exe 2884 WerFault.exe 2884 WerFault.exe 2884 WerFault.exe 2884 WerFault.exe 3580 WerFault.exe 3580 WerFault.exe 3580 WerFault.exe 3580 WerFault.exe 3580 WerFault.exe 3580 WerFault.exe 3580 WerFault.exe 3580 WerFault.exe 3580 WerFault.exe 3580 WerFault.exe 3580 WerFault.exe 3580 WerFault.exe 3580 WerFault.exe 3580 WerFault.exe 2376 WerFault.exe 2376 WerFault.exe 2376 WerFault.exe 2376 WerFault.exe 2376 WerFault.exe 2376 WerFault.exe 2376 WerFault.exe 2376 WerFault.exe 2376 WerFault.exe 2376 WerFault.exe 2376 WerFault.exe 2376 WerFault.exe 2376 WerFault.exe 2376 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 1872 WerFault.exe 1872 WerFault.exe 1872 WerFault.exe 1872 WerFault.exe 1872 WerFault.exe 1872 WerFault.exe 1872 WerFault.exe 1872 WerFault.exe 1872 WerFault.exe 1872 WerFault.exe 1872 WerFault.exe 1872 WerFault.exe 1872 WerFault.exe 1872 WerFault.exe 2960 WerFault.exe 2960 WerFault.exe 2960 WerFault.exe 2960 WerFault.exe 2960 WerFault.exe 2960 WerFault.exe 2960 WerFault.exe 2960 WerFault.exe 2960 WerFault.exe 2960 WerFault.exe 2960 WerFault.exe 2960 WerFault.exe 2960 WerFault.exe 2960 WerFault.exe 1656 WerFault.exe 1656 WerFault.exe 1656 WerFault.exe 1656 WerFault.exe 1656 WerFault.exe 1656 WerFault.exe 1656 WerFault.exe 1656 WerFault.exe 1656 WerFault.exe 1656 WerFault.exe 1656 WerFault.exe 1656 WerFault.exe 1656 WerFault.exe 1656 WerFault.exe 3956 WerFault.exe 3956 WerFault.exe 3956 WerFault.exe 3956 WerFault.exe 3956 WerFault.exe 3956 WerFault.exe 3956 WerFault.exe 3956 WerFault.exe 3956 WerFault.exe 3956 WerFault.exe 3956 WerFault.exe 3956 WerFault.exe 3956 WerFault.exe 3956 WerFault.exe 980 cebd48d8e9131c2de3e41c0eb028bf8cd8ce92de9df01443d1d24c217645b511.exe 980 cebd48d8e9131c2de3e41c0eb028bf8cd8ce92de9df01443d1d24c217645b511.exe 980 cebd48d8e9131c2de3e41c0eb028bf8cd8ce92de9df01443d1d24c217645b511.exe 980 cebd48d8e9131c2de3e41c0eb028bf8cd8ce92de9df01443d1d24c217645b511.exe 980 cebd48d8e9131c2de3e41c0eb028bf8cd8ce92de9df01443d1d24c217645b511.exe 980 cebd48d8e9131c2de3e41c0eb028bf8cd8ce92de9df01443d1d24c217645b511.exe - Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeRestorePrivilege 3136 WerFault.exe Token: SeBackupPrivilege 3136 WerFault.exe Token: SeDebugPrivilege 3136 WerFault.exe Token: SeDebugPrivilege 2880 WerFault.exe Token: SeDebugPrivilege 3676 WerFault.exe Token: SeDebugPrivilege 2972 WerFault.exe Token: SeDebugPrivilege 3952 WerFault.exe Token: SeDebugPrivilege 2884 WerFault.exe Token: SeDebugPrivilege 3580 WerFault.exe Token: SeDebugPrivilege 2376 WerFault.exe Token: SeDebugPrivilege 3044 WerFault.exe Token: SeDebugPrivilege 1872 WerFault.exe Token: SeDebugPrivilege 2960 WerFault.exe Token: SeDebugPrivilege 1656 WerFault.exe Token: SeDebugPrivilege 3956 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cebd48d8e9131c2de3e41c0eb028bf8cd8ce92de9df01443d1d24c217645b511.exe"C:\Users\Admin\AppData\Local\Temp\cebd48d8e9131c2de3e41c0eb028bf8cd8ce92de9df01443d1d24c217645b511.exe"1⤵PID:980
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 7842⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3136
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 9322⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2880
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 10802⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3676
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 10602⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2972
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 10922⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3952
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 11202⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2884
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 12082⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3580
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 14322⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2376
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 14602⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3044
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 16202⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1872
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 15762⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2960
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 16642⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1656
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 13362⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3956
-