Analysis
- max time kernel
65s - max time network
133s - platform
windows10_x64 - resource
win10v20210408 - submitted
17/06/2021, 09:40
Static task
static1
Behavioral task
behavioral1
Sample
3f891f4ea01741d664416c3b34f64208.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
3f891f4ea01741d664416c3b34f64208.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 3f891f4ea01741d664416c3b34f64208.exe
- Size 1.0MB
- Sample210617-4htbpt916a
- SHA256 dd1dea95bf17e3f135d2740e87d8b9f08ccf347e4ff832b9e747f775017ff346
- MD5 3f891f4ea01741d664416c3b34f64208
- SHA1 1603618f831c60c59c5748b620c9685f8609e1df
- SHA512 d25410bb7ef7f2c77921abd0995dc3b3e9e5c751c336831714cc19eec1d47b9eb04df693716bcbd307cc9ca416190b7f0603b1f60d169c9270bf5925cf249fb1
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 2104 created 648 2104 WerFault.exe 67 - Program crash 5 IoCs
pid pid_target Process procid_target 1332 648 WerFault.exe 67 1504 648 WerFault.exe 67 3768 648 WerFault.exe 67 2272 648 WerFault.exe 67 2104 648 WerFault.exe 67 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1332 WerFault.exe 1332 WerFault.exe 1332 WerFault.exe 1332 WerFault.exe 1332 WerFault.exe 1332 WerFault.exe 1332 WerFault.exe 1332 WerFault.exe 1332 WerFault.exe 1332 WerFault.exe 1332 WerFault.exe 1332 WerFault.exe 1332 WerFault.exe 1504 WerFault.exe 1504 WerFault.exe 1504 WerFault.exe 1504 WerFault.exe 1504 WerFault.exe 1504 WerFault.exe 1504 WerFault.exe 1504 WerFault.exe 1504 WerFault.exe 1504 WerFault.exe 1504 WerFault.exe 1504 WerFault.exe 1504 WerFault.exe 3768 WerFault.exe 3768 WerFault.exe 3768 WerFault.exe 3768 WerFault.exe 3768 WerFault.exe 3768 WerFault.exe 3768 WerFault.exe 3768 WerFault.exe 3768 WerFault.exe 3768 WerFault.exe 3768 WerFault.exe 3768 WerFault.exe 3768 WerFault.exe 2272 WerFault.exe 2272 WerFault.exe 2272 WerFault.exe 2272 WerFault.exe 2272 WerFault.exe 2272 WerFault.exe 2272 WerFault.exe 2272 WerFault.exe 2272 WerFault.exe 2272 WerFault.exe 2272 WerFault.exe 2272 WerFault.exe 2272 WerFault.exe 2104 WerFault.exe 2104 WerFault.exe 2104 WerFault.exe 2104 WerFault.exe 2104 WerFault.exe 2104 WerFault.exe 2104 WerFault.exe 2104 WerFault.exe 2104 WerFault.exe 2104 WerFault.exe 2104 WerFault.exe 2104 WerFault.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 1332 WerFault.exe Token: SeBackupPrivilege 1332 WerFault.exe Token: SeDebugPrivilege 1332 WerFault.exe Token: SeDebugPrivilege 1504 WerFault.exe Token: SeDebugPrivilege 3768 WerFault.exe Token: SeDebugPrivilege 2272 WerFault.exe Token: SeDebugPrivilege 2104 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f891f4ea01741d664416c3b34f64208.exe"C:\Users\Admin\AppData\Local\Temp\3f891f4ea01741d664416c3b34f64208.exe"1⤵PID:648
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 8122⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1332
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 9282⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1504
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 7922⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3768
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 9682⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2272
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 9842⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2104
-