fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57 | Triage

Resubmissions

24-03-2022 12:21

220324-pjqqysghd3 10

16-07-2021 18:28

210716-3mtspqxy36 3

Analysis

max time kernel
66s
max time network
152s
platform
windows10_x64
resource
win10v20210410
submitted
16-07-2021 18:28

Sharing

Report Analysis Logs

General

Target

fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57.exe
Size

788KB
MD5

e2bcd26465f9715da2789febce3bedf7
SHA1

b3bd4d0c84d0751d88eb0343b8e194e499894a98
SHA256

fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57
SHA512

17f6e5ebe109c652a0dce05de7ada1a0e3811f5558cf084398ece367a82f55fe1fd30797e20434db26a7d4245133e674db928c134c80f6e3297974f291c77219

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
616	3968	WerFault.exe	42

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
616	WerFault.exe
616	WerFault.exe
616	WerFault.exe
616	WerFault.exe
616	WerFault.exe
616	WerFault.exe
616	WerFault.exe
616	WerFault.exe
616	WerFault.exe
616	WerFault.exe
616	WerFault.exe
616	WerFault.exe
616	WerFault.exe
616	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	616	WerFault.exe
Token: SeBackupPrivilege	616	WerFault.exe
Token: SeDebugPrivilege	616	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57.exe
"C:\Users\Admin\AppData\Local\Temp\fabce973a9edff2c62ccb6fdd5b14c422bc215284f952f6b31cc2c7d98856d57.exe"
1⤵
PID:3968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 604
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3968-114-0x0000000013140000-0x0000000013C43000-memory.dmp

Filesize
11.0MB

Download