Analysis
- max time kernel
73s - max time network
135s - platform
windows10_x64 - resource
win10v20201028 - submitted
12/11/2020, 14:08
Static task
static1
Behavioral task
behavioral1
Sample
0f3a62b00591669252ec0442ec1cb08c4d48f24d91c0012c8f685226dca5fc50.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target 0f3a62b00591669252ec0442ec1cb08c4d48f24d91c0012c8f685226dca5fc50.exe
- Size 487KB
- Sample201112-phgxe5x16a
- SHA256 0f3a62b00591669252ec0442ec1cb08c4d48f24d91c0012c8f685226dca5fc50
- MD5 fa15ef9a1c8f164a9921c2097c8b79c6
- SHA1 6550e6401b5fc68e7a82e167811368902accf993
- SHA512 a8744b09786f4c3fc60113630a15c592be6358c45cda5a6b229b4629d21b9077670a60bf12091835e1826628f99390c7e003c2795fe55f77e326b0ec79ffc537
- MD5 SHA1 SHA512
Malware Config
Signatures
- Loads dropped DLL 6 IoCs
pid Process 4768 0f3a62b00591669252ec0442ec1cb08c4d48f24d91c0012c8f685226dca5fc50.exe 4768 0f3a62b00591669252ec0442ec1cb08c4d48f24d91c0012c8f685226dca5fc50.exe 4768 0f3a62b00591669252ec0442ec1cb08c4d48f24d91c0012c8f685226dca5fc50.exe 4768 0f3a62b00591669252ec0442ec1cb08c4d48f24d91c0012c8f685226dca5fc50.exe 4768 0f3a62b00591669252ec0442ec1cb08c4d48f24d91c0012c8f685226dca5fc50.exe 4768 0f3a62b00591669252ec0442ec1cb08c4d48f24d91c0012c8f685226dca5fc50.exe - Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- JavaScript code in executable 1 IoCs
resource yara_rule behavioral2/files/0x000100000001ab7f-303.dat js - Program crash 42 IoCs
pid pid_target Process procid_target 4200 4768 WerFault.exe 67 3224 4768 WerFault.exe 67 3924 4768 WerFault.exe 67 4156 4768 WerFault.exe 67 516 4768 WerFault.exe 67 904 4768 WerFault.exe 67 1368 4768 WerFault.exe 67 1712 4768 WerFault.exe 67 4076 4768 WerFault.exe 67 4032 4768 WerFault.exe 67 4504 4768 WerFault.exe 67 1616 4768 WerFault.exe 67 2332 4768 WerFault.exe 67 2428 4768 WerFault.exe 67 2456 4768 WerFault.exe 67 4352 4768 WerFault.exe 67 4812 4768 WerFault.exe 67 4024 4768 WerFault.exe 67 4664 4768 WerFault.exe 67 5024 4768 WerFault.exe 67 724 4768 WerFault.exe 67 4308 4768 WerFault.exe 67 1396 4768 WerFault.exe 67 1776 4768 WerFault.exe 67 1000 4768 WerFault.exe 67 4484 4768 WerFault.exe 67 4596 4768 WerFault.exe 67 2364 4768 WerFault.exe 67 4588 4768 WerFault.exe 67 1620 4768 WerFault.exe 67 3132 4768 WerFault.exe 67 4756 4768 WerFault.exe 67 4272 4768 WerFault.exe 67 3772 4768 WerFault.exe 67 4476 4768 WerFault.exe 67 1988 4768 WerFault.exe 67 2804 4768 WerFault.exe 67 1096 4768 WerFault.exe 67 4700 4768 WerFault.exe 67 2076 4768 WerFault.exe 67 4264 4768 WerFault.exe 67 3484 4768 WerFault.exe 67 - Delays execution with timeout.exe 1 IoCs
pid Process 4152 timeout.exe - Suspicious behavior: EnumeratesProcesses 617 IoCs
pid Process 4200 WerFault.exe 4200 WerFault.exe 4200 WerFault.exe 4200 WerFault.exe 4200 WerFault.exe 4200 WerFault.exe 4200 WerFault.exe 4200 WerFault.exe 4200 WerFault.exe 4200 WerFault.exe 4200 WerFault.exe 4200 WerFault.exe 4200 WerFault.exe 4200 WerFault.exe 3224 WerFault.exe 3224 WerFault.exe 3224 WerFault.exe 3224 WerFault.exe 3224 WerFault.exe 3224 WerFault.exe 3224 WerFault.exe 3224 WerFault.exe 3224 WerFault.exe 3224 WerFault.exe 3224 WerFault.exe 3224 WerFault.exe 3224 WerFault.exe 3224 WerFault.exe 3924 WerFault.exe 3924 WerFault.exe 3924 WerFault.exe 3924 WerFault.exe 3924 WerFault.exe 3924 WerFault.exe 3924 WerFault.exe 3924 WerFault.exe 3924 WerFault.exe 3924 WerFault.exe 3924 WerFault.exe 3924 WerFault.exe 3924 WerFault.exe 3924 WerFault.exe 4156 WerFault.exe 4156 WerFault.exe 4156 WerFault.exe 4156 WerFault.exe 4156 WerFault.exe 4156 WerFault.exe 4156 WerFault.exe 4156 WerFault.exe 4156 WerFault.exe 4156 WerFault.exe 4156 WerFault.exe 4156 WerFault.exe 4156 WerFault.exe 4156 WerFault.exe 516 WerFault.exe 516 WerFault.exe 516 WerFault.exe 516 WerFault.exe 516 WerFault.exe 516 WerFault.exe 516 WerFault.exe 516 WerFault.exe 516 WerFault.exe 516 WerFault.exe 516 WerFault.exe 516 WerFault.exe 516 WerFault.exe 516 WerFault.exe 904 WerFault.exe 904 WerFault.exe 904 WerFault.exe 904 WerFault.exe 904 WerFault.exe 904 WerFault.exe 904 WerFault.exe 904 WerFault.exe 904 WerFault.exe 904 WerFault.exe 904 WerFault.exe 904 WerFault.exe 904 WerFault.exe 904 WerFault.exe 1368 WerFault.exe 1368 WerFault.exe 1368 WerFault.exe 1368 WerFault.exe 1368 WerFault.exe 1368 WerFault.exe 1368 WerFault.exe 1368 WerFault.exe 1368 WerFault.exe 1368 WerFault.exe 1368 WerFault.exe 1368 WerFault.exe 1368 WerFault.exe 1368 WerFault.exe 1368 WerFault.exe 1712 WerFault.exe 1712 WerFault.exe 1712 WerFault.exe 1712 WerFault.exe 1712 WerFault.exe 1712 WerFault.exe 1712 WerFault.exe 1712 WerFault.exe 1712 WerFault.exe 1712 WerFault.exe 1712 WerFault.exe 1712 WerFault.exe 1712 WerFault.exe 1712 WerFault.exe 1712 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4076 WerFault.exe 4032 WerFault.exe 4032 WerFault.exe 4032 WerFault.exe 4032 WerFault.exe 4032 WerFault.exe 4032 WerFault.exe 4032 WerFault.exe 4032 WerFault.exe 4032 WerFault.exe 4032 WerFault.exe 4032 WerFault.exe 4032 WerFault.exe 4032 WerFault.exe 4032 WerFault.exe 4032 WerFault.exe 4504 WerFault.exe 4504 WerFault.exe 4504 WerFault.exe 4504 WerFault.exe 4504 WerFault.exe 4504 WerFault.exe 4504 WerFault.exe 4504 WerFault.exe 4504 WerFault.exe 4504 WerFault.exe 4504 WerFault.exe 4504 WerFault.exe 4504 WerFault.exe 4504 WerFault.exe 4504 WerFault.exe 1616 WerFault.exe 1616 WerFault.exe 1616 WerFault.exe 1616 WerFault.exe 1616 WerFault.exe 1616 WerFault.exe 1616 WerFault.exe 1616 WerFault.exe 1616 WerFault.exe 1616 WerFault.exe 1616 WerFault.exe 1616 WerFault.exe 1616 WerFault.exe 1616 WerFault.exe 1616 WerFault.exe 2332 WerFault.exe 2332 WerFault.exe 2332 WerFault.exe 2332 WerFault.exe 2332 WerFault.exe 2332 WerFault.exe 2332 WerFault.exe 2332 WerFault.exe 2332 WerFault.exe 2332 WerFault.exe 2332 WerFault.exe 2332 WerFault.exe 2332 WerFault.exe 2332 WerFault.exe 2332 WerFault.exe 2428 WerFault.exe 2428 WerFault.exe 2428 WerFault.exe 2428 WerFault.exe 2428 WerFault.exe 2428 WerFault.exe 2428 WerFault.exe 2428 WerFault.exe 2428 WerFault.exe 2428 WerFault.exe 2428 WerFault.exe 2428 WerFault.exe 2428 WerFault.exe 2428 WerFault.exe 2428 WerFault.exe 2456 WerFault.exe 2456 WerFault.exe 2456 WerFault.exe 2456 WerFault.exe 2456 WerFault.exe 2456 WerFault.exe 2456 WerFault.exe 2456 WerFault.exe 2456 WerFault.exe 2456 WerFault.exe 2456 WerFault.exe 2456 WerFault.exe 2456 WerFault.exe 2456 WerFault.exe 2456 WerFault.exe 4352 WerFault.exe 4352 WerFault.exe 4352 WerFault.exe 4352 WerFault.exe 4352 WerFault.exe 4352 WerFault.exe 4352 WerFault.exe 4352 WerFault.exe 4352 WerFault.exe 4352 WerFault.exe 4352 WerFault.exe 4352 WerFault.exe 4352 WerFault.exe 4352 WerFault.exe 4352 WerFault.exe 4812 WerFault.exe 4812 WerFault.exe 4812 WerFault.exe 4812 WerFault.exe 4812 WerFault.exe 4812 WerFault.exe 4812 WerFault.exe 4812 WerFault.exe 4812 WerFault.exe 4812 WerFault.exe 4812 WerFault.exe 4812 WerFault.exe 4812 WerFault.exe 4812 WerFault.exe 4812 WerFault.exe 4024 WerFault.exe 4024 WerFault.exe 4024 WerFault.exe 4024 WerFault.exe 4024 WerFault.exe 4024 WerFault.exe 4024 WerFault.exe 4024 WerFault.exe 4024 WerFault.exe 4024 WerFault.exe 4024 WerFault.exe 4024 WerFault.exe 4024 WerFault.exe 4024 WerFault.exe 4024 WerFault.exe 4664 WerFault.exe 4664 WerFault.exe 4664 WerFault.exe 4664 WerFault.exe 4664 WerFault.exe 4664 WerFault.exe 4664 WerFault.exe 4664 WerFault.exe 4664 WerFault.exe 4664 WerFault.exe 4664 WerFault.exe 4664 WerFault.exe 4664 WerFault.exe 4664 WerFault.exe 4664 WerFault.exe 5024 WerFault.exe 5024 WerFault.exe 5024 WerFault.exe 5024 WerFault.exe 5024 WerFault.exe 5024 WerFault.exe 5024 WerFault.exe 5024 WerFault.exe 5024 WerFault.exe 5024 WerFault.exe 5024 WerFault.exe 5024 WerFault.exe 5024 WerFault.exe 5024 WerFault.exe 5024 WerFault.exe 724 WerFault.exe 724 WerFault.exe 724 WerFault.exe 724 WerFault.exe 724 WerFault.exe 724 WerFault.exe 724 WerFault.exe 724 WerFault.exe 724 WerFault.exe 724 WerFault.exe 724 WerFault.exe 724 WerFault.exe 724 WerFault.exe 724 WerFault.exe 724 WerFault.exe 4308 WerFault.exe 4308 WerFault.exe 4308 WerFault.exe 4308 WerFault.exe 4308 WerFault.exe 4308 WerFault.exe 4308 WerFault.exe 4308 WerFault.exe 4308 WerFault.exe 4308 WerFault.exe 4308 WerFault.exe 4308 WerFault.exe 4308 WerFault.exe 4308 WerFault.exe 4308 WerFault.exe 1396 WerFault.exe 1396 WerFault.exe 1396 WerFault.exe 1396 WerFault.exe 1396 WerFault.exe 1396 WerFault.exe 1396 WerFault.exe 1396 WerFault.exe 1396 WerFault.exe 1396 WerFault.exe 1396 WerFault.exe 1396 WerFault.exe 1396 WerFault.exe 1396 WerFault.exe 1396 WerFault.exe 1776 WerFault.exe 1776 WerFault.exe 1776 WerFault.exe 1776 WerFault.exe 1776 WerFault.exe 1776 WerFault.exe 1776 WerFault.exe 1776 WerFault.exe 1776 WerFault.exe 1776 WerFault.exe 1776 WerFault.exe 1776 WerFault.exe 1776 WerFault.exe 1776 WerFault.exe 1776 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 1000 WerFault.exe 4484 WerFault.exe 4484 WerFault.exe 4484 WerFault.exe 4484 WerFault.exe 4484 WerFault.exe 4484 WerFault.exe 4484 WerFault.exe 4484 WerFault.exe 4484 WerFault.exe 4484 WerFault.exe 4484 WerFault.exe 4484 WerFault.exe 4484 WerFault.exe 4484 WerFault.exe 4484 WerFault.exe 4596 WerFault.exe 4596 WerFault.exe 4596 WerFault.exe 4596 WerFault.exe 4596 WerFault.exe 4596 WerFault.exe 4596 WerFault.exe 4596 WerFault.exe 4596 WerFault.exe 4596 WerFault.exe 4596 WerFault.exe 4596 WerFault.exe 4596 WerFault.exe 4596 WerFault.exe 4596 WerFault.exe 2364 WerFault.exe 2364 WerFault.exe 2364 WerFault.exe 2364 WerFault.exe 2364 WerFault.exe 2364 WerFault.exe 2364 WerFault.exe 2364 WerFault.exe 2364 WerFault.exe 2364 WerFault.exe 2364 WerFault.exe 2364 WerFault.exe 2364 WerFault.exe 2364 WerFault.exe 2364 WerFault.exe 4588 WerFault.exe 4588 WerFault.exe 4588 WerFault.exe 4588 WerFault.exe 4588 WerFault.exe 4588 WerFault.exe 4588 WerFault.exe 4588 WerFault.exe 4588 WerFault.exe 4588 WerFault.exe 4588 WerFault.exe 4588 WerFault.exe 4588 WerFault.exe 4588 WerFault.exe 4588 WerFault.exe 1620 WerFault.exe 1620 WerFault.exe 1620 WerFault.exe 1620 WerFault.exe 1620 WerFault.exe 1620 WerFault.exe 1620 WerFault.exe 1620 WerFault.exe 1620 WerFault.exe 1620 WerFault.exe 1620 WerFault.exe 1620 WerFault.exe 1620 WerFault.exe 1620 WerFault.exe 1620 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe 4756 WerFault.exe 4756 WerFault.exe 4756 WerFault.exe 4756 WerFault.exe 4756 WerFault.exe 4756 WerFault.exe 4756 WerFault.exe 4756 WerFault.exe 4756 WerFault.exe 4756 WerFault.exe 4756 WerFault.exe 4756 WerFault.exe 4756 WerFault.exe 4756 WerFault.exe 4756 WerFault.exe 4272 WerFault.exe 4272 WerFault.exe 4272 WerFault.exe 4272 WerFault.exe 4272 WerFault.exe 4272 WerFault.exe 4272 WerFault.exe 4272 WerFault.exe 4272 WerFault.exe 4272 WerFault.exe 4272 WerFault.exe 4272 WerFault.exe 4272 WerFault.exe 4272 WerFault.exe 4272 WerFault.exe 3772 WerFault.exe 3772 WerFault.exe 3772 WerFault.exe 3772 WerFault.exe 3772 WerFault.exe 3772 WerFault.exe 3772 WerFault.exe 3772 WerFault.exe 3772 WerFault.exe 3772 WerFault.exe 3772 WerFault.exe 3772 WerFault.exe 3772 WerFault.exe 3772 WerFault.exe 3772 WerFault.exe 4476 WerFault.exe 4476 WerFault.exe 4476 WerFault.exe 4476 WerFault.exe 4476 WerFault.exe 4476 WerFault.exe 4476 WerFault.exe 4476 WerFault.exe 4476 WerFault.exe 4476 WerFault.exe 4476 WerFault.exe 4476 WerFault.exe 4476 WerFault.exe 4476 WerFault.exe 4476 WerFault.exe 1988 WerFault.exe 1988 WerFault.exe 1988 WerFault.exe 1988 WerFault.exe 1988 WerFault.exe 1988 WerFault.exe 1988 WerFault.exe 1988 WerFault.exe 1988 WerFault.exe 1988 WerFault.exe 1988 WerFault.exe 1988 WerFault.exe 1988 WerFault.exe 1988 WerFault.exe 2804 WerFault.exe 2804 WerFault.exe 2804 WerFault.exe 2804 WerFault.exe 2804 WerFault.exe 2804 WerFault.exe 2804 WerFault.exe 2804 WerFault.exe 2804 WerFault.exe 2804 WerFault.exe 2804 WerFault.exe 2804 WerFault.exe 2804 WerFault.exe 2804 WerFault.exe 1096 WerFault.exe 1096 WerFault.exe 1096 WerFault.exe 1096 WerFault.exe 1096 WerFault.exe 1096 WerFault.exe 1096 WerFault.exe 1096 WerFault.exe 1096 WerFault.exe 1096 WerFault.exe 1096 WerFault.exe 1096 WerFault.exe 1096 WerFault.exe 1096 WerFault.exe 4700 WerFault.exe 4700 WerFault.exe 4700 WerFault.exe 4700 WerFault.exe 4700 WerFault.exe 4700 WerFault.exe 4700 WerFault.exe 4700 WerFault.exe 4700 WerFault.exe 4700 WerFault.exe 4700 WerFault.exe 4700 WerFault.exe 4700 WerFault.exe 4700 WerFault.exe 2076 WerFault.exe 2076 WerFault.exe 2076 WerFault.exe 2076 WerFault.exe 2076 WerFault.exe 2076 WerFault.exe 2076 WerFault.exe 2076 WerFault.exe 2076 WerFault.exe 2076 WerFault.exe 2076 WerFault.exe 2076 WerFault.exe 2076 WerFault.exe 2076 WerFault.exe 4264 WerFault.exe 4264 WerFault.exe 4264 WerFault.exe 4264 WerFault.exe 4264 WerFault.exe 4264 WerFault.exe 4264 WerFault.exe 4264 WerFault.exe 4264 WerFault.exe 4264 WerFault.exe 4264 WerFault.exe 4264 WerFault.exe 4264 WerFault.exe 4264 WerFault.exe 3484 WerFault.exe 3484 WerFault.exe 3484 WerFault.exe 3484 WerFault.exe 3484 WerFault.exe 3484 WerFault.exe 3484 WerFault.exe 3484 WerFault.exe 3484 WerFault.exe 3484 WerFault.exe 3484 WerFault.exe 3484 WerFault.exe 3484 WerFault.exe 3484 WerFault.exe - Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeRestorePrivilege 4200 WerFault.exe Token: SeBackupPrivilege 4200 WerFault.exe Token: SeDebugPrivilege 4200 WerFault.exe Token: SeDebugPrivilege 3224 WerFault.exe Token: SeDebugPrivilege 3924 WerFault.exe Token: SeDebugPrivilege 4156 WerFault.exe Token: SeDebugPrivilege 516 WerFault.exe Token: SeDebugPrivilege 904 WerFault.exe Token: SeDebugPrivilege 1368 WerFault.exe Token: SeDebugPrivilege 1712 WerFault.exe Token: SeDebugPrivilege 4076 WerFault.exe Token: SeDebugPrivilege 4032 WerFault.exe Token: SeDebugPrivilege 4504 WerFault.exe Token: SeDebugPrivilege 1616 WerFault.exe Token: SeDebugPrivilege 2332 WerFault.exe Token: SeDebugPrivilege 2428 WerFault.exe Token: SeDebugPrivilege 2456 WerFault.exe Token: SeDebugPrivilege 4352 WerFault.exe Token: SeDebugPrivilege 4812 WerFault.exe Token: SeDebugPrivilege 4024 WerFault.exe Token: SeDebugPrivilege 4664 WerFault.exe Token: SeDebugPrivilege 5024 WerFault.exe Token: SeDebugPrivilege 724 WerFault.exe Token: SeDebugPrivilege 4308 WerFault.exe Token: SeDebugPrivilege 1396 WerFault.exe Token: SeDebugPrivilege 1776 WerFault.exe Token: SeDebugPrivilege 1000 WerFault.exe Token: SeDebugPrivilege 4484 WerFault.exe Token: SeDebugPrivilege 4596 WerFault.exe Token: SeDebugPrivilege 2364 WerFault.exe Token: SeDebugPrivilege 4588 WerFault.exe Token: SeDebugPrivilege 1620 WerFault.exe Token: SeDebugPrivilege 3132 WerFault.exe Token: SeDebugPrivilege 4756 WerFault.exe Token: SeDebugPrivilege 4272 WerFault.exe Token: SeDebugPrivilege 3772 WerFault.exe Token: SeDebugPrivilege 4476 WerFault.exe Token: SeDebugPrivilege 1988 WerFault.exe Token: SeDebugPrivilege 2804 WerFault.exe Token: SeDebugPrivilege 1096 WerFault.exe Token: SeDebugPrivilege 4700 WerFault.exe Token: SeDebugPrivilege 2076 WerFault.exe Token: SeDebugPrivilege 4264 WerFault.exe Token: SeDebugPrivilege 3484 WerFault.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4768 wrote to memory of 4404 4768 0f3a62b00591669252ec0442ec1cb08c4d48f24d91c0012c8f685226dca5fc50.exe 121 PID 4768 wrote to memory of 4404 4768 0f3a62b00591669252ec0442ec1cb08c4d48f24d91c0012c8f685226dca5fc50.exe 121 PID 4768 wrote to memory of 4404 4768 0f3a62b00591669252ec0442ec1cb08c4d48f24d91c0012c8f685226dca5fc50.exe 121 PID 4404 wrote to memory of 4152 4404 cmd.exe 123 PID 4404 wrote to memory of 4152 4404 cmd.exe 123 PID 4404 wrote to memory of 4152 4404 cmd.exe 123
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f3a62b00591669252ec0442ec1cb08c4d48f24d91c0012c8f685226dca5fc50.exe"C:\Users\Admin\AppData\Local\Temp\0f3a62b00591669252ec0442ec1cb08c4d48f24d91c0012c8f685226dca5fc50.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 7362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4200
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 7082⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3224
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 8722⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3924
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 7522⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4156
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 11882⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:516
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 12642⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:904
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 13162⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1368
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 13282⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1712
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 13402⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4076
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 13802⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4032
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 14682⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4504
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 15002⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1616
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 14322⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2332
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 12882⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2428
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 15282⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2456
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 15602⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4352
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 15002⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4812
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 15202⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4024
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 13722⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4664
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 14642⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:5024
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 15082⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:724
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 15722⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4308
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 12362⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1396
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 14522⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1776
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 17442⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1000
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 18202⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4484
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 19162⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4596
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 17562⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2364
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 12282⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4588
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 18882⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1620
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 17922⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3132
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 13922⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4756
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 18602⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4272
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 20082⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3772
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 20282⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4476
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 19842⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1988
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 20042⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2804
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 19602⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1096
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 20162⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4700
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 12842⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2076
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 19802⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4264
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 18842⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3484
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\0f3a62b00591669252ec0442ec1cb08c4d48f24d91c0012c8f685226dca5fc50.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
PID:4152
-
-