Analysis
-
max time kernel
12s -
max time network
68s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
22-06-2021 14:07
Static task
static1
Behavioral task
behavioral1
Sample
6.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
6.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
6.exe
-
Size
21KB
-
MD5
24d60185a9e294a60c03b90fe731a04a
-
SHA1
c46b6a52efe81e02da8084f197efce7cb482f897
-
SHA256
0e9cb980e176c55c4694f8cb8b4fad949926887ec9e8ba209058bf22f2b359d6
-
SHA512
4419eaf48a932c9139c891ee36f51c8a7087357b2de56378a2c3399d8635f90460b30e16dc2b11db704a5f2e702fd116f292f723856b0fca008861eef8302674
Score
10/10
Malware Config
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 752 created 652 752 WerFault.exe 67 -
Program crash 1 IoCs
pid pid_target Process procid_target 752 652 WerFault.exe 67 -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 752 WerFault.exe 752 WerFault.exe 752 WerFault.exe 752 WerFault.exe 752 WerFault.exe 752 WerFault.exe 752 WerFault.exe 752 WerFault.exe 752 WerFault.exe 752 WerFault.exe 752 WerFault.exe 752 WerFault.exe 752 WerFault.exe 752 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 752 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6.exe"C:\Users\Admin\AppData\Local\Temp\6.exe"1⤵PID:652
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 652 -s 1322⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:752
-