Analysis
-
max time kernel
10s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
20-04-2021 03:41
Static task
static1
Behavioral task
behavioral1
Sample
f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe
Resource
win7v20210408
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe
Resource
win10v20210410
0 signatures
0 seconds
General
-
Target
f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe
-
Size
123KB
-
MD5
4f0abd7211e5bcb49a92591158d4d231
-
SHA1
f8e6d9646bf17d37f2aad9f5b82212f90f67b886
-
SHA256
b11f8065c37558a54799f1965283968f05754cd63328560148f59d54ed77351c
-
SHA512
3e5369dfd10eee1c0f456cd7aa94e095d289f9895f67046df25cac5294b7d6dde897fdc59425c8cd75c61ef6285ef5b645bc7a5f2d5de6b7f6a174bac70ee8fc
Score
10/10
Malware Config
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 1072 created 3176 1072 WerFault.exe f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exedescription pid process target process PID 3176 set thread context of 204 3176 f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1072 3176 WerFault.exe f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
WerFault.exepid process 1072 WerFault.exe 1072 WerFault.exe 1072 WerFault.exe 1072 WerFault.exe 1072 WerFault.exe 1072 WerFault.exe 1072 WerFault.exe 1072 WerFault.exe 1072 WerFault.exe 1072 WerFault.exe 1072 WerFault.exe 1072 WerFault.exe 1072 WerFault.exe 1072 WerFault.exe 1072 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 1072 WerFault.exe Token: SeBackupPrivilege 1072 WerFault.exe Token: SeDebugPrivilege 1072 WerFault.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exedescription pid process target process PID 3176 wrote to memory of 204 3176 f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe PID 3176 wrote to memory of 204 3176 f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe PID 3176 wrote to memory of 204 3176 f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe PID 3176 wrote to memory of 204 3176 f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe PID 3176 wrote to memory of 204 3176 f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe PID 3176 wrote to memory of 204 3176 f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe PID 3176 wrote to memory of 204 3176 f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe PID 3176 wrote to memory of 204 3176 f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe"C:\Users\Admin\AppData\Local\Temp\f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe"C:\Users\Admin\AppData\Local\Temp\f8e6d9646bf17d37f2aad9f5b82212f90f67b886.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3176 -s 2202⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken