Analysis
- max time kernel
130s - max time network
139s - platform
windows10_x64 - resource
win10v20201028 - submitted
17/11/2020, 11:53
Static task
static1
Behavioral task
behavioral1
Sample
847ff4d67d0f422dfecd2c6ddd7c608b.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
847ff4d67d0f422dfecd2c6ddd7c608b.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 847ff4d67d0f422dfecd2c6ddd7c608b.exe
- Size 681KB
- Sample201117-dbdg9cfl7e
- SHA256 3e74fecab3b22f6e9d2241b188809b50916d47ef96d5dfd024063a1e3c11f035
- MD5 85a74e0fddb5d3f52344b1bb76caada0
- SHA1 5aef23b9c3a6d00baa0ba9992af7291b0e5dc4f0
- SHA512 37b0c100e9425f43a62cab8bc556a4f48956515eae07395f88a8fd01bddd9e84024329b82e30016831e4e70062769189c5a2d6efd98c625cd7ae3a14ecef0f0c
- MD5 SHA1 SHA512
Score
3/10
Malware Config
Signatures
- Program crash 7 IoCs
pid pid_target Process procid_target 3140 984 WerFault.exe 67 2880 984 WerFault.exe 67 2380 984 WerFault.exe 67 192 984 WerFault.exe 67 1800 984 WerFault.exe 67 1376 984 WerFault.exe 67 3004 984 WerFault.exe 67 - Suspicious behavior: EnumeratesProcesses 97 IoCs
pid Process 3140 WerFault.exe 3140 WerFault.exe 3140 WerFault.exe 3140 WerFault.exe 3140 WerFault.exe 3140 WerFault.exe 3140 WerFault.exe 3140 WerFault.exe 3140 WerFault.exe 3140 WerFault.exe 3140 WerFault.exe 3140 WerFault.exe 3140 WerFault.exe 3140 WerFault.exe 2880 WerFault.exe 2880 WerFault.exe 2880 WerFault.exe 2880 WerFault.exe 2880 WerFault.exe 2880 WerFault.exe 2880 WerFault.exe 2880 WerFault.exe 2880 WerFault.exe 2880 WerFault.exe 2880 WerFault.exe 2880 WerFault.exe 2880 WerFault.exe 2880 WerFault.exe 2380 WerFault.exe 2380 WerFault.exe 2380 WerFault.exe 2380 WerFault.exe 2380 WerFault.exe 2380 WerFault.exe 2380 WerFault.exe 2380 WerFault.exe 2380 WerFault.exe 2380 WerFault.exe 2380 WerFault.exe 2380 WerFault.exe 2380 WerFault.exe 2380 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 1800 WerFault.exe 1800 WerFault.exe 1800 WerFault.exe 1800 WerFault.exe 1800 WerFault.exe 1800 WerFault.exe 1800 WerFault.exe 1800 WerFault.exe 1800 WerFault.exe 1800 WerFault.exe 1800 WerFault.exe 1800 WerFault.exe 1800 WerFault.exe 1800 WerFault.exe 1376 WerFault.exe 1376 WerFault.exe 1376 WerFault.exe 1376 WerFault.exe 1376 WerFault.exe 1376 WerFault.exe 1376 WerFault.exe 1376 WerFault.exe 1376 WerFault.exe 1376 WerFault.exe 1376 WerFault.exe 1376 WerFault.exe 1376 WerFault.exe 1376 WerFault.exe 3004 WerFault.exe 3004 WerFault.exe 3004 WerFault.exe 3004 WerFault.exe 3004 WerFault.exe 3004 WerFault.exe 3004 WerFault.exe 3004 WerFault.exe 3004 WerFault.exe 3004 WerFault.exe 3004 WerFault.exe 3004 WerFault.exe 3004 WerFault.exe - Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeRestorePrivilege 3140 WerFault.exe Token: SeBackupPrivilege 3140 WerFault.exe Token: SeDebugPrivilege 3140 WerFault.exe Token: SeDebugPrivilege 2880 WerFault.exe Token: SeDebugPrivilege 2380 WerFault.exe Token: SeDebugPrivilege 192 WerFault.exe Token: SeDebugPrivilege 1800 WerFault.exe Token: SeDebugPrivilege 1376 WerFault.exe Token: SeDebugPrivilege 3004 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\847ff4d67d0f422dfecd2c6ddd7c608b.exe"C:\Users\Admin\AppData\Local\Temp\847ff4d67d0f422dfecd2c6ddd7c608b.exe"1⤵PID:984
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 8402⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3140
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 9322⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2880
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 10762⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2380
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 11322⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:192
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 11722⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1800
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 12042⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1376
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 9442⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3004
-