Analysis
-
max time kernel
19s -
max time network
99s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 20:57
Static task
static1
Behavioral task
behavioral1
Sample
d3858f7891a8d353754c41758558cc675a5a0941851cf52ba6deda822b76558e.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
d3858f7891a8d353754c41758558cc675a5a0941851cf52ba6deda822b76558e.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
d3858f7891a8d353754c41758558cc675a5a0941851cf52ba6deda822b76558e.exe
-
Size
514KB
-
MD5
aa95fd8cf4cc7a275d543782915ba443
-
SHA1
3500853918f101e23b7e9c9331f5fd8e33595203
-
SHA256
d3858f7891a8d353754c41758558cc675a5a0941851cf52ba6deda822b76558e
-
SHA512
f76e6b00bd2824847603048cbc16631e2a8af37b783f83bd00800b2e15b67260f28bcfd41abe5d8acff52a3c2172eb14c04266b825274950de5c39467eb23b62
Score
3/10
Malware Config
Signatures
-
Program crash 6 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 544 1124 WerFault.exe d3858f7891a8d353754c41758558cc675a5a0941851cf52ba6deda822b76558e.exe 528 1124 WerFault.exe d3858f7891a8d353754c41758558cc675a5a0941851cf52ba6deda822b76558e.exe 1384 1124 WerFault.exe d3858f7891a8d353754c41758558cc675a5a0941851cf52ba6deda822b76558e.exe 192 1124 WerFault.exe d3858f7891a8d353754c41758558cc675a5a0941851cf52ba6deda822b76558e.exe 3876 1124 WerFault.exe d3858f7891a8d353754c41758558cc675a5a0941851cf52ba6deda822b76558e.exe 3948 1124 WerFault.exe d3858f7891a8d353754c41758558cc675a5a0941851cf52ba6deda822b76558e.exe -
Suspicious behavior: EnumeratesProcesses 84 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid process 544 WerFault.exe 544 WerFault.exe 544 WerFault.exe 544 WerFault.exe 544 WerFault.exe 544 WerFault.exe 544 WerFault.exe 544 WerFault.exe 544 WerFault.exe 544 WerFault.exe 544 WerFault.exe 544 WerFault.exe 544 WerFault.exe 544 WerFault.exe 528 WerFault.exe 528 WerFault.exe 528 WerFault.exe 528 WerFault.exe 528 WerFault.exe 528 WerFault.exe 528 WerFault.exe 528 WerFault.exe 528 WerFault.exe 528 WerFault.exe 528 WerFault.exe 528 WerFault.exe 528 WerFault.exe 528 WerFault.exe 1384 WerFault.exe 1384 WerFault.exe 1384 WerFault.exe 1384 WerFault.exe 1384 WerFault.exe 1384 WerFault.exe 1384 WerFault.exe 1384 WerFault.exe 1384 WerFault.exe 1384 WerFault.exe 1384 WerFault.exe 1384 WerFault.exe 1384 WerFault.exe 1384 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 3876 WerFault.exe 3876 WerFault.exe 3876 WerFault.exe 3876 WerFault.exe 3876 WerFault.exe 3876 WerFault.exe 3876 WerFault.exe 3876 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription pid process Token: SeRestorePrivilege 544 WerFault.exe Token: SeBackupPrivilege 544 WerFault.exe Token: SeDebugPrivilege 544 WerFault.exe Token: SeDebugPrivilege 528 WerFault.exe Token: SeDebugPrivilege 1384 WerFault.exe Token: SeDebugPrivilege 192 WerFault.exe Token: SeDebugPrivilege 3876 WerFault.exe Token: SeDebugPrivilege 3948 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d3858f7891a8d353754c41758558cc675a5a0941851cf52ba6deda822b76558e.exe"C:\Users\Admin\AppData\Local\Temp\d3858f7891a8d353754c41758558cc675a5a0941851cf52ba6deda822b76558e.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 7362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 8482⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 8962⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 8762⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 11882⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 12242⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/192-17-0x0000000004710000-0x0000000004711000-memory.dmpFilesize
4KB
-
memory/192-14-0x00000000040E0000-0x00000000040E1000-memory.dmpFilesize
4KB
-
memory/528-6-0x0000000004A50000-0x0000000004A51000-memory.dmpFilesize
4KB
-
memory/544-3-0x0000000004F80000-0x0000000004F81000-memory.dmpFilesize
4KB
-
memory/544-5-0x0000000005630000-0x0000000005631000-memory.dmpFilesize
4KB
-
memory/544-2-0x0000000004F80000-0x0000000004F81000-memory.dmpFilesize
4KB
-
memory/1124-0-0x0000000002456000-0x0000000002457000-memory.dmpFilesize
4KB
-
memory/1124-1-0x00000000040B0000-0x00000000040B1000-memory.dmpFilesize
4KB
-
memory/1384-10-0x00000000049E0000-0x00000000049E1000-memory.dmpFilesize
4KB
-
memory/1384-13-0x0000000004F10000-0x0000000004F11000-memory.dmpFilesize
4KB
-
memory/3876-18-0x0000000004790000-0x0000000004791000-memory.dmpFilesize
4KB
-
memory/3876-21-0x0000000005040000-0x0000000005041000-memory.dmpFilesize
4KB
-
memory/3948-22-0x0000000004C60000-0x0000000004C61000-memory.dmpFilesize
4KB
-
memory/3948-26-0x0000000005510000-0x0000000005511000-memory.dmpFilesize
4KB