317548e41fedb6b8f007c2ed885f115ac15bfee4388cdd436ba9f56ec373e263

General

Target

317548e41fedb6b8f007c2ed885f115ac15bfee4388cdd436ba9f56ec373e263.exe
Size

598KB
MD5

ef270fa7a49769eebc7f602379bfbbe7
SHA1

6ed3455711390f4e4615a5ac20aa46f0202f779f
SHA256

317548e41fedb6b8f007c2ed885f115ac15bfee4388cdd436ba9f56ec373e263
SHA512

951e18cfc25f3aecccde8d83a708972d03da0cdd98cde6d78f0a8a563dfdabffd63a9c60f8a1c5bc3abae8b502c3b4e7bd751bbb2c5c256db6247e585fc219cf

Score

3^/10

Malware Config

Signatures

Program crash 13 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3160	580	WerFault.exe	317548e41fedb6b8f007c2ed885f115ac15bfee4388cdd436ba9f56ec373e263.exe
3404	580	WerFault.exe	317548e41fedb6b8f007c2ed885f115ac15bfee4388cdd436ba9f56ec373e263.exe
752	580	WerFault.exe	317548e41fedb6b8f007c2ed885f115ac15bfee4388cdd436ba9f56ec373e263.exe
948	580	WerFault.exe	317548e41fedb6b8f007c2ed885f115ac15bfee4388cdd436ba9f56ec373e263.exe
2720	580	WerFault.exe	317548e41fedb6b8f007c2ed885f115ac15bfee4388cdd436ba9f56ec373e263.exe
1380	580	WerFault.exe	317548e41fedb6b8f007c2ed885f115ac15bfee4388cdd436ba9f56ec373e263.exe
2236	580	WerFault.exe	317548e41fedb6b8f007c2ed885f115ac15bfee4388cdd436ba9f56ec373e263.exe
2320	580	WerFault.exe	317548e41fedb6b8f007c2ed885f115ac15bfee4388cdd436ba9f56ec373e263.exe
2160	580	WerFault.exe	317548e41fedb6b8f007c2ed885f115ac15bfee4388cdd436ba9f56ec373e263.exe
3844	580	WerFault.exe	317548e41fedb6b8f007c2ed885f115ac15bfee4388cdd436ba9f56ec373e263.exe
3732	580	WerFault.exe	317548e41fedb6b8f007c2ed885f115ac15bfee4388cdd436ba9f56ec373e263.exe
2572	580	WerFault.exe	317548e41fedb6b8f007c2ed885f115ac15bfee4388cdd436ba9f56ec373e263.exe
3916	580	WerFault.exe	317548e41fedb6b8f007c2ed885f115ac15bfee4388cdd436ba9f56ec373e263.exe

Suspicious behavior: EnumeratesProcesses 188 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	process
3160	WerFault.exe
3160	WerFault.exe
3160	WerFault.exe
3160	WerFault.exe
3160	WerFault.exe
3160	WerFault.exe
3160	WerFault.exe
3160	WerFault.exe
3160	WerFault.exe
3160	WerFault.exe
3160	WerFault.exe
3160	WerFault.exe
3160	WerFault.exe
3160	WerFault.exe
3404	WerFault.exe
3404	WerFault.exe
3404	WerFault.exe
3404	WerFault.exe
3404	WerFault.exe
3404	WerFault.exe
3404	WerFault.exe
3404	WerFault.exe
3404	WerFault.exe
3404	WerFault.exe
3404	WerFault.exe
3404	WerFault.exe
3404	WerFault.exe
3404	WerFault.exe
752	WerFault.exe
752	WerFault.exe
752	WerFault.exe
752	WerFault.exe
752	WerFault.exe
752	WerFault.exe
752	WerFault.exe
752	WerFault.exe
752	WerFault.exe
752	WerFault.exe
752	WerFault.exe
752	WerFault.exe
752	WerFault.exe
752	WerFault.exe
948	WerFault.exe
948	WerFault.exe
948	WerFault.exe
948	WerFault.exe
948	WerFault.exe
948	WerFault.exe
948	WerFault.exe
948	WerFault.exe
948	WerFault.exe
948	WerFault.exe
948	WerFault.exe
948	WerFault.exe
948	WerFault.exe
948	WerFault.exe
2720	WerFault.exe
2720	WerFault.exe
2720	WerFault.exe
2720	WerFault.exe
2720	WerFault.exe
2720	WerFault.exe
2720	WerFault.exe
2720	WerFault.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

description	pid	process
Token: SeRestorePrivilege	3160	WerFault.exe
Token: SeBackupPrivilege	3160	WerFault.exe
Token: SeDebugPrivilege	3160	WerFault.exe
Token: SeDebugPrivilege	3404	WerFault.exe
Token: SeDebugPrivilege	752	WerFault.exe
Token: SeDebugPrivilege	948	WerFault.exe
Token: SeDebugPrivilege	2720	WerFault.exe
Token: SeDebugPrivilege	1380	WerFault.exe
Token: SeDebugPrivilege	2236	WerFault.exe
Token: SeDebugPrivilege	2320	WerFault.exe
Token: SeDebugPrivilege	2160	WerFault.exe
Token: SeDebugPrivilege	3844	WerFault.exe
Token: SeDebugPrivilege	3732	WerFault.exe
Token: SeDebugPrivilege	2572	WerFault.exe
Token: SeDebugPrivilege	3916	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\317548e41fedb6b8f007c2ed885f115ac15bfee4388cdd436ba9f56ec373e263.exe
"C:\Users\Admin\AppData\Local\Temp\317548e41fedb6b8f007c2ed885f115ac15bfee4388cdd436ba9f56ec373e263.exe"
1⤵
PID:580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 824
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 936
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 1076
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 1064
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 1056
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 1108
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 1208
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 1172
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 1164
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 1640
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 1604
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 1204
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 1660
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/580-1-0x0000000002B80000-0x0000000002B81000-memory.dmp

Filesize
4KB

Download
memory/580-0-0x0000000000F04000-0x0000000000F05000-memory.dmp

Filesize
4KB

Download
memory/752-10-0x0000000004850000-0x0000000004851000-memory.dmp

Filesize
4KB

Download
memory/752-13-0x0000000004D80000-0x0000000004D81000-memory.dmp

Filesize
4KB

Download
memory/948-17-0x0000000005400000-0x0000000005401000-memory.dmp

Filesize
4KB

Download
memory/948-14-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

Filesize
4KB

Download
memory/1380-25-0x0000000005170000-0x0000000005171000-memory.dmp

Filesize
4KB

Download
memory/1380-22-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

Filesize
4KB

Download
memory/2160-37-0x0000000005320000-0x0000000005321000-memory.dmp

Filesize
4KB

Download
memory/2160-34-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

Filesize
4KB

Download
memory/2236-29-0x0000000005080000-0x0000000005081000-memory.dmp

Filesize
4KB

Download
memory/2236-26-0x0000000004D40000-0x0000000004D41000-memory.dmp

Filesize
4KB

Download
memory/2320-33-0x0000000004CE0000-0x0000000004CE1000-memory.dmp

Filesize
4KB

Download
memory/2320-30-0x00000000046B0000-0x00000000046B1000-memory.dmp

Filesize
4KB

Download
memory/2572-49-0x0000000005700000-0x0000000005701000-memory.dmp

Filesize
4KB

Download
memory/2572-46-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

Filesize
4KB

Download
memory/2720-21-0x0000000005530000-0x0000000005531000-memory.dmp

Filesize
4KB

Download
memory/2720-18-0x0000000005100000-0x0000000005101000-memory.dmp

Filesize
4KB

Download
memory/3160-2-0x0000000004500000-0x0000000004501000-memory.dmp

Filesize
4KB

Download
memory/3160-3-0x0000000004500000-0x0000000004501000-memory.dmp

Filesize
4KB

Download
memory/3160-5-0x0000000004A30000-0x0000000004A31000-memory.dmp

Filesize
4KB

Download
memory/3404-9-0x0000000005670000-0x0000000005671000-memory.dmp

Filesize
4KB

Download
memory/3404-6-0x0000000005040000-0x0000000005041000-memory.dmp

Filesize
4KB

Download
memory/3732-42-0x00000000048B0000-0x00000000048B1000-memory.dmp

Filesize
4KB

Download
memory/3732-45-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

Filesize
4KB

Download
memory/3844-38-0x0000000004310000-0x0000000004311000-memory.dmp

Filesize
4KB

Download
memory/3844-41-0x0000000004A40000-0x0000000004A41000-memory.dmp

Filesize
4KB

Download
memory/3916-50-0x00000000045A0000-0x00000000045A1000-memory.dmp

Filesize
4KB

Download
memory/3916-53-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads