Analysis
-
max time kernel
66s -
max time network
131s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
08-11-2020 17:45
Static task
static1
Behavioral task
behavioral1
Sample
d6681dad6e90b5bc334137f7c07657e1403d6ba18ca6ef0121b535884f137b35.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
d6681dad6e90b5bc334137f7c07657e1403d6ba18ca6ef0121b535884f137b35.exe
Resource
win10v20201028
General
-
Target
d6681dad6e90b5bc334137f7c07657e1403d6ba18ca6ef0121b535884f137b35.exe
-
Size
681KB
-
MD5
dab4b4c3cfdfc873bbc3919c9c8d078a
-
SHA1
ced6e59f897d64aeb24936f688559155be85d8db
-
SHA256
d6681dad6e90b5bc334137f7c07657e1403d6ba18ca6ef0121b535884f137b35
-
SHA512
b1bd80fd0ee0b28d7593ad4ee7e5381f5ca1db98ec48407c45fed60948d6683ccbcb4c2be9bef773ff1bc674de592cb2b2ad93a4aafbf770560024779c0963c1
Malware Config
Signatures
-
Program crash 14 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2800 3160 WerFault.exe d6681dad6e90b5bc334137f7c07657e1403d6ba18ca6ef0121b535884f137b35.exe 3972 3160 WerFault.exe d6681dad6e90b5bc334137f7c07657e1403d6ba18ca6ef0121b535884f137b35.exe 1544 3160 WerFault.exe d6681dad6e90b5bc334137f7c07657e1403d6ba18ca6ef0121b535884f137b35.exe 2292 3160 WerFault.exe d6681dad6e90b5bc334137f7c07657e1403d6ba18ca6ef0121b535884f137b35.exe 3856 3160 WerFault.exe d6681dad6e90b5bc334137f7c07657e1403d6ba18ca6ef0121b535884f137b35.exe 2652 3160 WerFault.exe d6681dad6e90b5bc334137f7c07657e1403d6ba18ca6ef0121b535884f137b35.exe 3896 3160 WerFault.exe d6681dad6e90b5bc334137f7c07657e1403d6ba18ca6ef0121b535884f137b35.exe 2036 3160 WerFault.exe d6681dad6e90b5bc334137f7c07657e1403d6ba18ca6ef0121b535884f137b35.exe 3960 3160 WerFault.exe d6681dad6e90b5bc334137f7c07657e1403d6ba18ca6ef0121b535884f137b35.exe 196 3160 WerFault.exe d6681dad6e90b5bc334137f7c07657e1403d6ba18ca6ef0121b535884f137b35.exe 1892 3160 WerFault.exe d6681dad6e90b5bc334137f7c07657e1403d6ba18ca6ef0121b535884f137b35.exe 3400 3160 WerFault.exe d6681dad6e90b5bc334137f7c07657e1403d6ba18ca6ef0121b535884f137b35.exe 496 3160 WerFault.exe d6681dad6e90b5bc334137f7c07657e1403d6ba18ca6ef0121b535884f137b35.exe 2104 3160 WerFault.exe d6681dad6e90b5bc334137f7c07657e1403d6ba18ca6ef0121b535884f137b35.exe -
Suspicious behavior: EnumeratesProcesses 205 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid process 2800 WerFault.exe 2800 WerFault.exe 2800 WerFault.exe 2800 WerFault.exe 2800 WerFault.exe 2800 WerFault.exe 2800 WerFault.exe 2800 WerFault.exe 2800 WerFault.exe 2800 WerFault.exe 2800 WerFault.exe 2800 WerFault.exe 2800 WerFault.exe 2800 WerFault.exe 3972 WerFault.exe 3972 WerFault.exe 3972 WerFault.exe 3972 WerFault.exe 3972 WerFault.exe 3972 WerFault.exe 3972 WerFault.exe 3972 WerFault.exe 3972 WerFault.exe 3972 WerFault.exe 3972 WerFault.exe 3972 WerFault.exe 3972 WerFault.exe 3972 WerFault.exe 1544 WerFault.exe 1544 WerFault.exe 1544 WerFault.exe 1544 WerFault.exe 1544 WerFault.exe 1544 WerFault.exe 1544 WerFault.exe 1544 WerFault.exe 1544 WerFault.exe 1544 WerFault.exe 1544 WerFault.exe 1544 WerFault.exe 1544 WerFault.exe 1544 WerFault.exe 2292 WerFault.exe 2292 WerFault.exe 2292 WerFault.exe 2292 WerFault.exe 2292 WerFault.exe 2292 WerFault.exe 2292 WerFault.exe 2292 WerFault.exe 2292 WerFault.exe 2292 WerFault.exe 2292 WerFault.exe 2292 WerFault.exe 2292 WerFault.exe 2292 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription pid process Token: SeRestorePrivilege 2800 WerFault.exe Token: SeBackupPrivilege 2800 WerFault.exe Token: SeDebugPrivilege 2800 WerFault.exe Token: SeDebugPrivilege 3972 WerFault.exe Token: SeDebugPrivilege 1544 WerFault.exe Token: SeDebugPrivilege 2292 WerFault.exe Token: SeDebugPrivilege 3856 WerFault.exe Token: SeDebugPrivilege 2652 WerFault.exe Token: SeDebugPrivilege 3896 WerFault.exe Token: SeDebugPrivilege 2036 WerFault.exe Token: SeDebugPrivilege 3960 WerFault.exe Token: SeDebugPrivilege 196 WerFault.exe Token: SeDebugPrivilege 1892 WerFault.exe Token: SeDebugPrivilege 3400 WerFault.exe Token: SeDebugPrivilege 496 WerFault.exe Token: SeDebugPrivilege 2104 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6681dad6e90b5bc334137f7c07657e1403d6ba18ca6ef0121b535884f137b35.exe"C:\Users\Admin\AppData\Local\Temp\d6681dad6e90b5bc334137f7c07657e1403d6ba18ca6ef0121b535884f137b35.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 8282⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 9362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 10802⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 10522⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 11402⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 11922⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 12962⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 15322⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 16762⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 17282⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 18002⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 18322⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 18762⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 17482⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/196-46-0x0000000004670000-0x0000000004671000-memory.dmpFilesize
4KB
-
memory/196-49-0x0000000004EA0000-0x0000000004EA1000-memory.dmpFilesize
4KB
-
memory/496-72-0x0000000004AB0000-0x0000000004AB1000-memory.dmpFilesize
4KB
-
memory/1544-10-0x00000000049E0000-0x00000000049E1000-memory.dmpFilesize
4KB
-
memory/1544-13-0x0000000005010000-0x0000000005011000-memory.dmpFilesize
4KB
-
memory/1892-53-0x0000000005070000-0x0000000005071000-memory.dmpFilesize
4KB
-
memory/1892-50-0x0000000004840000-0x0000000004841000-memory.dmpFilesize
4KB
-
memory/2036-38-0x0000000004380000-0x0000000004381000-memory.dmpFilesize
4KB
-
memory/2036-41-0x0000000004BB0000-0x0000000004BB1000-memory.dmpFilesize
4KB
-
memory/2104-80-0x0000000005180000-0x0000000005181000-memory.dmpFilesize
4KB
-
memory/2104-76-0x00000000048D0000-0x00000000048D1000-memory.dmpFilesize
4KB
-
memory/2292-14-0x0000000004E80000-0x0000000004E81000-memory.dmpFilesize
4KB
-
memory/2292-17-0x00000000054B0000-0x00000000054B1000-memory.dmpFilesize
4KB
-
memory/2652-22-0x0000000004660000-0x0000000004661000-memory.dmpFilesize
4KB
-
memory/2652-25-0x0000000004D90000-0x0000000004D91000-memory.dmpFilesize
4KB
-
memory/2800-2-0x00000000043A0000-0x00000000043A1000-memory.dmpFilesize
4KB
-
memory/2800-3-0x00000000043A0000-0x00000000043A1000-memory.dmpFilesize
4KB
-
memory/2800-5-0x00000000048D0000-0x00000000048D1000-memory.dmpFilesize
4KB
-
memory/3160-1-0x0000000002B70000-0x0000000002B71000-memory.dmpFilesize
4KB
-
memory/3160-37-0x0000000002C70000-0x0000000002C71000-memory.dmpFilesize
4KB
-
memory/3160-0-0x0000000001095000-0x0000000001096000-memory.dmpFilesize
4KB
-
memory/3400-54-0x0000000004CE0000-0x0000000004CE1000-memory.dmpFilesize
4KB
-
memory/3856-18-0x00000000052A0000-0x00000000052A1000-memory.dmpFilesize
4KB
-
memory/3896-33-0x0000000004AB0000-0x0000000004AB1000-memory.dmpFilesize
4KB
-
memory/3896-36-0x0000000004FF0000-0x0000000004FF1000-memory.dmpFilesize
4KB
-
memory/3960-45-0x0000000005250000-0x0000000005251000-memory.dmpFilesize
4KB
-
memory/3960-42-0x00000000049A0000-0x00000000049A1000-memory.dmpFilesize
4KB
-
memory/3972-9-0x0000000004720000-0x0000000004721000-memory.dmpFilesize
4KB
-
memory/3972-6-0x0000000004070000-0x0000000004071000-memory.dmpFilesize
4KB