94fff127753ed1d704c781b5c391f5e62f4a907b67f7e1d51c3c84addd5851ab | Triage

Analysis

max time kernel
13s
max time network
110s
platform
windows10_x64
resource
win10v20201028
submitted
31-01-2021 14:48

Sharing

Report Analysis Logs

General

Target

94fff127753ed1d704c781b5c391f5e62f4a907b67f7e1d51c3c84addd5851ab.exe
Size

197KB
MD5

039ce25d495fa555ae1c210592b564d0
SHA1

6684d0ffde174052a03931981262dc0a7cb9891c
SHA256

94fff127753ed1d704c781b5c391f5e62f4a907b67f7e1d51c3c84addd5851ab
SHA512

c2be8d6b80e57339957f370b4ac31bd03140f9a9ed4865926eb6d7e5a69d3510b046930c1933d38629b4c3bcae007b6cf5e6140463ab6e064820cdd91bbd46bb

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

496 652 WerFault.exe 94fff127753ed1d704c781b5c391f5e62f4a907b67f7e1d51c3c84addd5851ab.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
496	WerFault.exe
496	WerFault.exe
496	WerFault.exe
496	WerFault.exe
496	WerFault.exe
496	WerFault.exe
496	WerFault.exe
496	WerFault.exe
496	WerFault.exe
496	WerFault.exe
496	WerFault.exe
496	WerFault.exe
496	WerFault.exe
496	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 496 WerFault.exe
Token: SeBackupPrivilege 496 WerFault.exe
Token: SeDebugPrivilege 496 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\94fff127753ed1d704c781b5c391f5e62f4a907b67f7e1d51c3c84addd5851ab.exe
"C:\Users\Admin\AppData\Local\Temp\94fff127753ed1d704c781b5c391f5e62f4a907b67f7e1d51c3c84addd5851ab.exe"
1⤵
PID:652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 576
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/496-2-0x00000000043D0000-0x00000000043D1000-memory.dmp

Filesize
4KB

Download
memory/652-3-0x00000000001E0000-0x00000000001F5000-memory.dmp

Filesize
84KB

Download