253de8145c186c3d3ff60304eab1f23f4fdd50eb38a212c94847578226af433c | Triage

Analysis

max time kernel
16s
max time network
111s
platform
windows10_x64
resource
win10v20201028
submitted
15-03-2021 23:08

Sharing

Report Analysis Logs

General

Target

90eca63d6ac05c375af58247435cea9fa724335f946e4576986a25a553dcb852.exe
Size

59KB
MD5

dc014e9681ed57207d64443cb2bbe34c
SHA1

e56f420bfb14a01b042563e1bdf6380c1a45a76c
SHA256

90eca63d6ac05c375af58247435cea9fa724335f946e4576986a25a553dcb852
SHA512

347113544311ce154da6c1755e7a5b9ebac00c9b4fa9d91e58ef81bf886da0b3faef453fe12e965b003f59890644742786ae14b2671196443914fc3a8c7bac1f

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3784 496 WerFault.exe 90eca63d6ac05c375af58247435cea9fa724335f946e4576986a25a553dcb852.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe
3784	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3784 WerFault.exe
Token: SeBackupPrivilege 3784 WerFault.exe
Token: SeDebugPrivilege 3784 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\90eca63d6ac05c375af58247435cea9fa724335f946e4576986a25a553dcb852.exe
"C:\Users\Admin\AppData\Local\Temp\90eca63d6ac05c375af58247435cea9fa724335f946e4576986a25a553dcb852.exe"
1⤵
PID:496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 496 -s 404
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3784-2-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

Filesize
4KB

Download