f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675 | Triage

Analysis

max time kernel
11s
max time network
120s
platform
windows10_x64
resource
win10v20210408
submitted
22/06/2021, 14:06

Sharing

Report Analysis Logs

General

Target

3.exe
Size

21KB
MD5

4160c35d3c600712b528e8072de1bc58
SHA1

12c822103678fed7b928f0202eb7e51714ab3b56
SHA256

f2ab74ce11c4462db427db65ff5755db4d5267d373172384a241017150e14675
SHA512

f722f7a5560641b0cbeb73dfb9d495cf2920858acfdcd5806f619256f2810569486be00eee4547b07298ca20c18d478f3f567809a7b2ff9cf81519e057a3a962

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1652 created 656	1652	WerFault.exe	67

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1652	656	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1652	WerFault.exe
1652	WerFault.exe
1652	WerFault.exe
1652	WerFault.exe
1652	WerFault.exe
1652	WerFault.exe
1652	WerFault.exe
1652	WerFault.exe
1652	WerFault.exe
1652	WerFault.exe
1652	WerFault.exe
1652	WerFault.exe
1652	WerFault.exe
1652	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1652	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\3.exe
"C:\Users\Admin\AppData\Local\Temp\3.exe"
1⤵
PID:656
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 656 -s 132
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads