91a8d66f5c1f651e0f60c456fa8dd06347f69be8ba5542f9c6781e6714962fa9 | Triage

Analysis

max time kernel
13s
max time network
152s
platform
windows10_x64
resource
win10v20210410
submitted
30-07-2021 09:06

Sharing

Report Analysis Logs

General

Target

MakeSignature.exe
Size

1.5MB
MD5

65050987d23fc2645b902be63251c88e
SHA1

938402d9aa8984218cdf1ce2c7de10d743186522
SHA256

209dd4c6724dafd5efa5547ca539fb77577b3eb53e5b8f49880083e9b5654505
SHA512

028ae64d29f467602f99c37080c1aa2625c236417a1858153431c7196aa549c53521fdb95eb5602adb8d5bf304d6941f0901d3bd13dfd1a9dd09761c2d50bbb4

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1720 508 WerFault.exe MakeSignature.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

WerFault.exe

pid	process
1720	WerFault.exe
1720	WerFault.exe
1720	WerFault.exe
1720	WerFault.exe
1720	WerFault.exe
1720	WerFault.exe
1720	WerFault.exe
1720	WerFault.exe
1720	WerFault.exe
1720	WerFault.exe
1720	WerFault.exe
1720	WerFault.exe
1720	WerFault.exe
1720	WerFault.exe
1720	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1720 WerFault.exe
Token: SeBackupPrivilege 1720 WerFault.exe
Token: SeDebugPrivilege 1720 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\MakeSignature.exe
"C:\Users\Admin\AppData\Local\Temp\MakeSignature.exe"
1⤵
PID:508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 816
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1720

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/508-114-0x0000000000711000-0x0000000000714000-memory.dmp

Filesize
12KB

Download
memory/508-115-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download