253de8145c186c3d3ff60304eab1f23f4fdd50eb38a212c94847578226af433c | Triage

Analysis

max time kernel
19s
max time network
99s
platform
windows10_x64
resource
win10v20201028
submitted
15-03-2021 23:08

Sharing

Report Analysis Logs

General

Target

c087a84574092eba9510c17f425853ce.exe
Size

128KB
MD5

c087a84574092eba9510c17f425853ce
SHA1

015a499f638d2c3bbb453ca98b31a3ac6203b2b7
SHA256

2a56e792c187c3b59f0f62b58dcd92d8137581ad83eeff0b86c120e78c3bba13
SHA512

68df03dc8ccc6d386f4c00c2491c0ce0e337af3f46c89bb586894901215280ec171a032b6913fe6201f92324c1cdc049f0515e9b65170352957cf0d19eec21ce

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

792 1308 WerFault.exe c087a84574092eba9510c17f425853ce.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
792	WerFault.exe
792	WerFault.exe
792	WerFault.exe
792	WerFault.exe
792	WerFault.exe
792	WerFault.exe
792	WerFault.exe
792	WerFault.exe
792	WerFault.exe
792	WerFault.exe
792	WerFault.exe
792	WerFault.exe
792	WerFault.exe
792	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 792 WerFault.exe
Token: SeBackupPrivilege 792 WerFault.exe
Token: SeDebugPrivilege 792 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\c087a84574092eba9510c17f425853ce.exe
"C:\Users\Admin\AppData\Local\Temp\c087a84574092eba9510c17f425853ce.exe"
1⤵
PID:1308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 412
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/792-2-0x00000000047B0000-0x00000000047B1000-memory.dmp

Filesize
4KB

Download