Analysis
- max time kernel
137s - max time network
139s - platform
windows10_x64 - resource
win10v20201028 - submitted
12/11/2020, 14:35
Static task
static1
Behavioral task
behavioral1
Sample
a1df8fda42b6b799d3abb21d18a29ce4c770680ca6efce7acf68ce7e53e2f662.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a1df8fda42b6b799d3abb21d18a29ce4c770680ca6efce7acf68ce7e53e2f662.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target a1df8fda42b6b799d3abb21d18a29ce4c770680ca6efce7acf68ce7e53e2f662.exe
- Size 514KB
- Sample201112-j8tpfgtde6
- SHA256 a1df8fda42b6b799d3abb21d18a29ce4c770680ca6efce7acf68ce7e53e2f662
- MD5 b2586a7ae5ab71f6c019a6ca71d720e0
- SHA1 2688833d4a811b084795175ae74906c0773d6594
- SHA512 e2797e4776fecddaad66062ff2c278d208f769e4263071f74310d9d5f407663dc20e93390505c7f0c5c48b0f69412dbe42b62818b1f53c55c1a9e63bccb57bd1
- MD5 SHA1 SHA512
Score
3/10
Malware Config
Signatures
- Program crash 6 IoCs
pid pid_target Process procid_target 3844 3324 WerFault.exe 67 3996 3324 WerFault.exe 67 4028 3324 WerFault.exe 67 1464 3324 WerFault.exe 67 1160 3324 WerFault.exe 67 1956 3324 WerFault.exe 67 - Suspicious behavior: EnumeratesProcesses 84 IoCs
pid Process 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 1464 WerFault.exe 1464 WerFault.exe 1464 WerFault.exe 1464 WerFault.exe 1464 WerFault.exe 1464 WerFault.exe 1464 WerFault.exe 1464 WerFault.exe 1464 WerFault.exe 1464 WerFault.exe 1464 WerFault.exe 1464 WerFault.exe 1464 WerFault.exe 1464 WerFault.exe 1160 WerFault.exe 1160 WerFault.exe 1160 WerFault.exe 1160 WerFault.exe 1160 WerFault.exe 1160 WerFault.exe 1160 WerFault.exe 1160 WerFault.exe 1160 WerFault.exe 1160 WerFault.exe 1160 WerFault.exe 1160 WerFault.exe 1160 WerFault.exe 1160 WerFault.exe 1956 WerFault.exe 1956 WerFault.exe 1956 WerFault.exe 1956 WerFault.exe 1956 WerFault.exe 1956 WerFault.exe 1956 WerFault.exe 1956 WerFault.exe 1956 WerFault.exe 1956 WerFault.exe 1956 WerFault.exe 1956 WerFault.exe 1956 WerFault.exe 1956 WerFault.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeRestorePrivilege 3844 WerFault.exe Token: SeBackupPrivilege 3844 WerFault.exe Token: SeDebugPrivilege 3844 WerFault.exe Token: SeDebugPrivilege 3996 WerFault.exe Token: SeDebugPrivilege 4028 WerFault.exe Token: SeDebugPrivilege 1464 WerFault.exe Token: SeDebugPrivilege 1160 WerFault.exe Token: SeDebugPrivilege 1956 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1df8fda42b6b799d3abb21d18a29ce4c770680ca6efce7acf68ce7e53e2f662.exe"C:\Users\Admin\AppData\Local\Temp\a1df8fda42b6b799d3abb21d18a29ce4c770680ca6efce7acf68ce7e53e2f662.exe"1⤵PID:3324
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 7362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3844
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 8122⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3996
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 8962⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4028
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 9442⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1464
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 11882⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1160
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 12122⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1956
-