0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250 | Triage

Analysis

max time kernel
148s
max time network
148s
platform
windows10_x64
resource
win10v20210410
submitted
13-05-2021 12:57

Sharing

Report Analysis Logs

General

Target

0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe
Size

2.0MB
MD5

bbb5ac24fff7f744f85c92080b9b3648
SHA1

bb74591747b1936d966119c12da21c8836659e0b
SHA256

0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250
SHA512

b409772bc32dea1d676f3dcca18cdb62fa364c5f32e671ac39c351eed95cca97dbdcfab1fad76cc869af2c4430a1ff18a1c13e792713b9f05424d4a56b889ee3

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2116 3176 WerFault.exe 0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2116 WerFault.exe
Token: SeBackupPrivilege 2116 WerFault.exe
Token: SeDebugPrivilege 2116 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe
"C:\Users\Admin\AppData\Local\Temp\0c2f07cdc6867474f1449072dd553249f1ef1aa19dac2abef98ba2f4baa15250.exe"
1⤵
PID:3176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3176 -s 248
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2116

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...