ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43 | Triage

Analysis

max time kernel
131s
max time network
136s
platform
windows10_x64
resource
win10v20210410
submitted
04-05-2021 20:28

Sharing

Report Analysis Logs

General

Target

ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
Size

430KB
MD5

ab8f50a8ce75108e39e110f206b9d281
SHA1

e523bf8ab764f9072cef29528e626bfa19bec808
SHA256

ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43
SHA512

8d5fcc88f7811cedfb2ab00fc86288a7642c8cdf72b057b2a134a78ebccce078cb8858ae377cea2d26d751133b41c19277a0fe7a443e16cc1069156a5ab1956a

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1660 2232 WerFault.exe ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
1660	WerFault.exe
1660	WerFault.exe
1660	WerFault.exe
1660	WerFault.exe
1660	WerFault.exe
1660	WerFault.exe
1660	WerFault.exe
1660	WerFault.exe
1660	WerFault.exe
1660	WerFault.exe
1660	WerFault.exe
1660	WerFault.exe
1660	WerFault.exe
1660	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1660 WerFault.exe
Token: SeBackupPrivilege 1660 WerFault.exe
Token: SeDebugPrivilege 1660 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
"C:\Users\Admin\AppData\Local\Temp\ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe"
1⤵
PID:2232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 480
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1660

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...