253de8145c186c3d3ff60304eab1f23f4fdd50eb38a212c94847578226af433c | Triage

Analysis

max time kernel
18s
max time network
113s
platform
windows10_x64
resource
win10v20201028
submitted
15-03-2021 23:08

Sharing

Report Analysis Logs

General

Target

2fc4602468f243f742b496683ee9bd6ff22c4c85b56567eff3df2bf7ef5c495b.exe
Size

100KB
MD5

ab3bfa9ef77a888353ed05d0bed7e931
SHA1

71c44b922b3de2db1e6c63a846e92850973526fc
SHA256

2fc4602468f243f742b496683ee9bd6ff22c4c85b56567eff3df2bf7ef5c495b
SHA512

4e48b0f765a8a9af0dfe035b98c9ea2b3928a802111e04f12b82d8f7222b9565006e6c282451a26ee33ea0b581502ca5c475e76ebfc001cb16d4b93d02e24b81

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3164 724 WerFault.exe 2fc4602468f243f742b496683ee9bd6ff22c4c85b56567eff3df2bf7ef5c495b.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3164	WerFault.exe
3164	WerFault.exe
3164	WerFault.exe
3164	WerFault.exe
3164	WerFault.exe
3164	WerFault.exe
3164	WerFault.exe
3164	WerFault.exe
3164	WerFault.exe
3164	WerFault.exe
3164	WerFault.exe
3164	WerFault.exe
3164	WerFault.exe
3164	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3164 WerFault.exe
Token: SeBackupPrivilege 3164 WerFault.exe
Token: SeDebugPrivilege 3164 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2fc4602468f243f742b496683ee9bd6ff22c4c85b56567eff3df2bf7ef5c495b.exe
"C:\Users\Admin\AppData\Local\Temp\2fc4602468f243f742b496683ee9bd6ff22c4c85b56567eff3df2bf7ef5c495b.exe"
1⤵
PID:724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 724 -s 404
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3164

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3164-2-0x0000000004210000-0x0000000004211000-memory.dmp

Filesize
4KB

Download