64f47b9926b043d9cf1d18b181ff042d65f9b56ee5d741d4453f96d065a3a1bf | Triage

Analysis

max time kernel
87s
max time network
154s
platform
windows10_x64
resource
win10v20210410
submitted
01-07-2021 07:48

Sharing

Report Analysis Logs

General

Target

64f47b9926b043d9cf1d18b181ff042d65f9b56ee5d741d4453f96d065a3a1bf.exe
Size

345KB
MD5

fca7cd09c6b0891b8ba0c3613e2315be
SHA1

2cefb93e51a31a453bd1bfd2722da254c2254d2f
SHA256

64f47b9926b043d9cf1d18b181ff042d65f9b56ee5d741d4453f96d065a3a1bf
SHA512

69d85d8b650a40f6f3423ef2dfecf71cabf43a25f7bb1dac5ab302e090d7bb34b8ac34e9bc8e842dac3c1119786a81509cc18f4ce95987ad487a0e0b1eeb8d4d

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3228 4048 WerFault.exe 64f47b9926b043d9cf1d18b181ff042d65f9b56ee5d741d4453f96d065a3a1bf.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3228	WerFault.exe
3228	WerFault.exe
3228	WerFault.exe
3228	WerFault.exe
3228	WerFault.exe
3228	WerFault.exe
3228	WerFault.exe
3228	WerFault.exe
3228	WerFault.exe
3228	WerFault.exe
3228	WerFault.exe
3228	WerFault.exe
3228	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3228 WerFault.exe
Token: SeBackupPrivilege 3228 WerFault.exe
Token: SeDebugPrivilege 3228 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\64f47b9926b043d9cf1d18b181ff042d65f9b56ee5d741d4453f96d065a3a1bf.exe
"C:\Users\Admin\AppData\Local\Temp\64f47b9926b043d9cf1d18b181ff042d65f9b56ee5d741d4453f96d065a3a1bf.exe"
1⤵
PID:4048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 500
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3228

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4048-114-0x0000000000460000-0x00000000004A7000-memory.dmp

Filesize
284KB

Download
memory/4048-115-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download