25b93e036415a70c292d3c3befd7e7f8919f714860882aeac25f16422633f16a | Triage

Analysis

max time kernel
10s
max time network
135s
platform
windows10_x64
resource
win10v20210410
submitted
21-07-2021 22:00

Sharing

Report Analysis Logs

General

Target

05096a801e403309a7968d36a09b7091.exe
Size

21KB
MD5

05096a801e403309a7968d36a09b7091
SHA1

c7016541d0addbd75b3e7bf20b8356d757ada471
SHA256

25b93e036415a70c292d3c3befd7e7f8919f714860882aeac25f16422633f16a
SHA512

f3d4621c8f27fae3e16b5dd2e8b0d616ced3ce51ec5b21b8a3efbfbdd83930be2105eb5d8fe7f7a7da51a929d0fbe7f0d5b6d69c6f94a9943a48f1f434f6ec36

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4000 4048 WerFault.exe 05096a801e403309a7968d36a09b7091.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
4000	WerFault.exe
4000	WerFault.exe
4000	WerFault.exe
4000	WerFault.exe
4000	WerFault.exe
4000	WerFault.exe
4000	WerFault.exe
4000	WerFault.exe
4000	WerFault.exe
4000	WerFault.exe
4000	WerFault.exe
4000	WerFault.exe
4000	WerFault.exe
4000	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

05096a801e403309a7968d36a09b7091.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	4048	05096a801e403309a7968d36a09b7091.exe
Token: SeRestorePrivilege	4000	WerFault.exe
Token: SeBackupPrivilege	4000	WerFault.exe
Token: SeDebugPrivilege	4000	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\05096a801e403309a7968d36a09b7091.exe
"C:\Users\Admin\AppData\Local\Temp\05096a801e403309a7968d36a09b7091.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 1400
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4048-114-0x0000000000810000-0x0000000000811000-memory.dmp

Filesize
4KB

Download
memory/4048-116-0x0000000005070000-0x0000000005071000-memory.dmp

Filesize
4KB

Download
memory/4048-117-0x0000000005110000-0x0000000005111000-memory.dmp

Filesize
4KB

Download
memory/4048-118-0x00000000052E0000-0x00000000052E1000-memory.dmp

Filesize
4KB

Download