7503351b46e00a2ca012bebc4ea6d3271a93a2711f41636753ffb61f2fec64d0 | Triage

Analysis

max time kernel
14s
max time network
115s
platform
windows10_x64
resource
win10v20210410
submitted
26-07-2021 12:40

Sharing

Report Analysis Logs

General

Target

7503351b46e00a2ca012bebc4ea6d3271a93a2711f41636753ffb61f2fec64d0.sample.exe
Size

157KB
MD5

d684db00442fa867abdcbe4bc9d03dcb
SHA1

f3b7b9986ab0d1784781b99502b17f126888cf82
SHA256

7503351b46e00a2ca012bebc4ea6d3271a93a2711f41636753ffb61f2fec64d0
SHA512

e02b0de9989e3741030112d36aec3a1038ab030b1e8f434342841c66b0c788ebc3d562ea339b49606a28c494883546df3af79e5bab4317cda99f503f5fc2bf43

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1636 1496 WerFault.exe 7503351b46e00a2ca012bebc4ea6d3271a93a2711f41636753ffb61f2fec64d0.sample.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
1636	WerFault.exe
1636	WerFault.exe
1636	WerFault.exe
1636	WerFault.exe
1636	WerFault.exe
1636	WerFault.exe
1636	WerFault.exe
1636	WerFault.exe
1636	WerFault.exe
1636	WerFault.exe
1636	WerFault.exe
1636	WerFault.exe
1636	WerFault.exe
1636	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1636 WerFault.exe
Token: SeBackupPrivilege 1636 WerFault.exe
Token: SeDebugPrivilege 1636 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\7503351b46e00a2ca012bebc4ea6d3271a93a2711f41636753ffb61f2fec64d0.sample.exe
"C:\Users\Admin\AppData\Local\Temp\7503351b46e00a2ca012bebc4ea6d3271a93a2711f41636753ffb61f2fec64d0.sample.exe"
1⤵
PID:1496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1496 -s 504
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1636

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...