50ad0e6e9dc72d10579c20bb436f09eeaa7bfdbcb5747a2590af667823e85609 | Triage

Analysis

max time kernel
13s
max time network
113s
platform
windows10_x64
resource
win10v20210410
submitted
30-07-2021 09:53

Sharing

Report Analysis Logs

General

Target

50ad0e6e9dc72d10579c20bb436f09eeaa7bfdbcb5747a2590af667823e85609.exe
Size

2.5MB
MD5

01c846bfc37b10ea43474e1781e0af52
SHA1

edba1b73ddd0e32784ae21844c940d7850531b82
SHA256

50ad0e6e9dc72d10579c20bb436f09eeaa7bfdbcb5747a2590af667823e85609
SHA512

94345f6c4a2b1edce2875a022f3daafff945e74a6f6a00e257379f3e4a52d99f5e969376fe6be37d5f8d76fb4afcda2a451445a203bc676f599c855703ae11cd

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 1784 created 1496 1784 WerFault.exe 50ad0e6e9dc72d10579c20bb436f09eeaa7bfdbcb5747a2590af667823e85609.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1784 1496 WerFault.exe 50ad0e6e9dc72d10579c20bb436f09eeaa7bfdbcb5747a2590af667823e85609.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
1784	WerFault.exe
1784	WerFault.exe
1784	WerFault.exe
1784	WerFault.exe
1784	WerFault.exe
1784	WerFault.exe
1784	WerFault.exe
1784	WerFault.exe
1784	WerFault.exe
1784	WerFault.exe
1784	WerFault.exe
1784	WerFault.exe
1784	WerFault.exe
1784	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1784 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\50ad0e6e9dc72d10579c20bb436f09eeaa7bfdbcb5747a2590af667823e85609.exe
"C:\Users\Admin\AppData\Local\Temp\50ad0e6e9dc72d10579c20bb436f09eeaa7bfdbcb5747a2590af667823e85609.exe"
1⤵
PID:1496

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1496 -s 152
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1784

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...