Analysis
-
max time kernel
12s -
max time network
107s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
15-11-2020 23:17
Static task
static1
Behavioral task
behavioral1
Sample
8f3d2ecd0612dd35e0236219aa59ebaa3b2628764356f1a4ca93a8b2887e9ccb.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
8f3d2ecd0612dd35e0236219aa59ebaa3b2628764356f1a4ca93a8b2887e9ccb.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
8f3d2ecd0612dd35e0236219aa59ebaa3b2628764356f1a4ca93a8b2887e9ccb.exe
-
Size
514KB
-
MD5
1485c59ea69f380b4c6f26a18ca9c970
-
SHA1
743a83ccaa5a17cf085a5e6f5332de7e067a9a77
-
SHA256
8f3d2ecd0612dd35e0236219aa59ebaa3b2628764356f1a4ca93a8b2887e9ccb
-
SHA512
9aacaace02330a2bb48909d3c56aa4e9ea838e9854e8ef22f6bb88f22cd1d6cbfd67955259548c749bad25e88733b9cd29bb9321c87e8ab717a2bfbc174882fc
Score
3/10
Malware Config
Signatures
-
Program crash 5 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4240 4760 WerFault.exe 8f3d2ecd0612dd35e0236219aa59ebaa3b2628764356f1a4ca93a8b2887e9ccb.exe 3180 4760 WerFault.exe 8f3d2ecd0612dd35e0236219aa59ebaa3b2628764356f1a4ca93a8b2887e9ccb.exe 4212 4760 WerFault.exe 8f3d2ecd0612dd35e0236219aa59ebaa3b2628764356f1a4ca93a8b2887e9ccb.exe 1776 4760 WerFault.exe 8f3d2ecd0612dd35e0236219aa59ebaa3b2628764356f1a4ca93a8b2887e9ccb.exe 560 4760 WerFault.exe 8f3d2ecd0612dd35e0236219aa59ebaa3b2628764356f1a4ca93a8b2887e9ccb.exe -
Suspicious behavior: EnumeratesProcesses 72 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid process 4240 WerFault.exe 4240 WerFault.exe 4240 WerFault.exe 4240 WerFault.exe 4240 WerFault.exe 4240 WerFault.exe 4240 WerFault.exe 4240 WerFault.exe 4240 WerFault.exe 4240 WerFault.exe 4240 WerFault.exe 4240 WerFault.exe 4240 WerFault.exe 4240 WerFault.exe 3180 WerFault.exe 3180 WerFault.exe 3180 WerFault.exe 3180 WerFault.exe 3180 WerFault.exe 3180 WerFault.exe 3180 WerFault.exe 3180 WerFault.exe 3180 WerFault.exe 3180 WerFault.exe 3180 WerFault.exe 3180 WerFault.exe 3180 WerFault.exe 3180 WerFault.exe 4212 WerFault.exe 4212 WerFault.exe 4212 WerFault.exe 4212 WerFault.exe 4212 WerFault.exe 4212 WerFault.exe 4212 WerFault.exe 4212 WerFault.exe 4212 WerFault.exe 4212 WerFault.exe 4212 WerFault.exe 4212 WerFault.exe 4212 WerFault.exe 4212 WerFault.exe 1776 WerFault.exe 1776 WerFault.exe 1776 WerFault.exe 1776 WerFault.exe 1776 WerFault.exe 1776 WerFault.exe 1776 WerFault.exe 1776 WerFault.exe 1776 WerFault.exe 1776 WerFault.exe 1776 WerFault.exe 1776 WerFault.exe 1776 WerFault.exe 1776 WerFault.exe 1776 WerFault.exe 560 WerFault.exe 560 WerFault.exe 560 WerFault.exe 560 WerFault.exe 560 WerFault.exe 560 WerFault.exe 560 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription pid process Token: SeRestorePrivilege 4240 WerFault.exe Token: SeBackupPrivilege 4240 WerFault.exe Token: SeDebugPrivilege 4240 WerFault.exe Token: SeDebugPrivilege 3180 WerFault.exe Token: SeDebugPrivilege 4212 WerFault.exe Token: SeDebugPrivilege 1776 WerFault.exe Token: SeDebugPrivilege 560 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f3d2ecd0612dd35e0236219aa59ebaa3b2628764356f1a4ca93a8b2887e9ccb.exe"C:\Users\Admin\AppData\Local\Temp\8f3d2ecd0612dd35e0236219aa59ebaa3b2628764356f1a4ca93a8b2887e9ccb.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 7362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 8482⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 8762⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 9162⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 11882⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/560-24-0x0000000004DA0000-0x0000000004DA1000-memory.dmpFilesize
4KB
-
memory/560-27-0x00000000054D0000-0x00000000054D1000-memory.dmpFilesize
4KB
-
memory/1776-18-0x0000000004700000-0x0000000004701000-memory.dmpFilesize
4KB
-
memory/3180-6-0x0000000004700000-0x0000000004701000-memory.dmpFilesize
4KB
-
memory/3180-11-0x00000000048F0000-0x00000000048F1000-memory.dmpFilesize
4KB
-
memory/4212-12-0x0000000004700000-0x0000000004701000-memory.dmpFilesize
4KB
-
memory/4240-2-0x0000000004870000-0x0000000004871000-memory.dmpFilesize
4KB
-
memory/4240-3-0x0000000004870000-0x0000000004871000-memory.dmpFilesize
4KB
-
memory/4240-5-0x0000000004EA0000-0x0000000004EA1000-memory.dmpFilesize
4KB
-
memory/4760-0-0x0000000002586000-0x0000000002587000-memory.dmpFilesize
4KB
-
memory/4760-1-0x0000000004130000-0x0000000004131000-memory.dmpFilesize
4KB