34e2b2fa1abca7861f992884d64a531c651ce8b852adb4741f2f8b00f8d053dc | Triage

Analysis

max time kernel
11s
max time network
113s
platform
windows10_x64
resource
win10v20210410
submitted
22-06-2021 15:22

Sharing

Report Analysis Logs

General

Target

34e2b2fa1abca7861f992884d64a531c651ce8b852adb4741f2f8b00f8d053dc.exe
Size

316KB
MD5

2709c2a92b2fcecebbc21bcd4e340aea
SHA1

32e13a4be25e1a0b16d52ad1d8cf64f2cb6e029e
SHA256

34e2b2fa1abca7861f992884d64a531c651ce8b852adb4741f2f8b00f8d053dc
SHA512

bbce933beaf9b8098db70fe899d138d41d5cc04a9ccbf454fbf1d1aa4898fcea6f49ab4f9409addd051c28f3f08f6ce63fcf0996b35383c3ac66663947e75366

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2720 4012 WerFault.exe 34e2b2fa1abca7861f992884d64a531c651ce8b852adb4741f2f8b00f8d053dc.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
2720	WerFault.exe
2720	WerFault.exe
2720	WerFault.exe
2720	WerFault.exe
2720	WerFault.exe
2720	WerFault.exe
2720	WerFault.exe
2720	WerFault.exe
2720	WerFault.exe
2720	WerFault.exe
2720	WerFault.exe
2720	WerFault.exe
2720	WerFault.exe
2720	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2720 WerFault.exe
Token: SeBackupPrivilege 2720 WerFault.exe
Token: SeDebugPrivilege 2720 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\34e2b2fa1abca7861f992884d64a531c651ce8b852adb4741f2f8b00f8d053dc.exe
"C:\Users\Admin\AppData\Local\Temp\34e2b2fa1abca7861f992884d64a531c651ce8b852adb4741f2f8b00f8d053dc.exe"
1⤵
PID:4012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4012 -s 512
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2720

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4012-114-0x0000000000460000-0x000000000050E000-memory.dmp

Filesize
696KB

Download
memory/4012-115-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download