d8ae822e44e2ad95a337f793dae84fa9faef1b0a781eebeeb5f8b028a98001e0 | Triage™

Analysis

max time kernel
12s
max time network
113s
platform
windows10_x64
resource
win10v20201028
submitted
24/01/2021, 17:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d8ae822e44e2ad95a337f793dae84fa9faef1b0a781eebeeb5f8b028a98001e0.exe
Size 115KB
Sample210124-e714l9l2fj
SHA256 d8ae822e44e2ad95a337f793dae84fa9faef1b0a781eebeeb5f8b028a98001e0
MD5 4fa54f63cabdb41682ce263c0ec39887
SHA1 ae173f6bcfaa77eeab5e080b5bd1be0e7915705a
SHA512 49aa4179abaec4c33ad36acd7543ec04808f9b010c57ef81ea6a5344cc518d9d9f69756742dea62b28b5fc2e47ea071a817010a92da2468b60577c581a5efd7d
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1772	4020	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1772	WerFault.exe
1772	WerFault.exe
1772	WerFault.exe
1772	WerFault.exe
1772	WerFault.exe
1772	WerFault.exe
1772	WerFault.exe
1772	WerFault.exe
1772	WerFault.exe
1772	WerFault.exe
1772	WerFault.exe
1772	WerFault.exe
1772	WerFault.exe
1772	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	1772	WerFault.exe
Token: SeBackupPrivilege	1772	WerFault.exe
Token: SeDebugPrivilege	1772	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\d8ae822e44e2ad95a337f793dae84fa9faef1b0a781eebeeb5f8b028a98001e0.exe
"C:\Users\Admin\AppData\Local\Temp\d8ae822e44e2ad95a337f793dae84fa9faef1b0a781eebeeb5f8b028a98001e0.exe"
1⤵
PID:4020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 520
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1772-2-0x0000000004F10000-0x0000000004F11000-memory.dmp

Download