Analysis
- max time kernel
12s - max time network
115s - platform
windows10_x64 - resource
win10v20210410 - submitted
09/08/2021, 03:38
Static task
static1
Behavioral task
behavioral1
Sample
a2b8cf09d6dd866faa2ff72c553081ad.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a2b8cf09d6dd866faa2ff72c553081ad.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target a2b8cf09d6dd866faa2ff72c553081ad.exe
- Size 264KB
- Sample210809-48eh5cxdr6
- SHA256 53364173f3b4771f13cf0f8c6d4e19717f9097d3680e62a09d69186cb71001c8
- MD5 a2b8cf09d6dd866faa2ff72c553081ad
- SHA1 955afd9dae7c07f72bc9e3394b0e37de41d3aab3
- SHA512 fdea959e9013a2bad3a70525e7c5bf17b6b42e245044fb39feda72b1e161be119305eecde0d39382e55331ea0bc0fbeb5960b4ec720b7f3cce20674aa667df51
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 1280 created 3172 1280 WerFault.exe 64 - Program crash 6 IoCs
pid pid_target Process procid_target 2876 3172 WerFault.exe 64 4004 3172 WerFault.exe 64 196 3172 WerFault.exe 64 1948 3172 WerFault.exe 64 2172 3172 WerFault.exe 64 1280 3172 WerFault.exe 64 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2876 WerFault.exe 2876 WerFault.exe 2876 WerFault.exe 2876 WerFault.exe 2876 WerFault.exe 2876 WerFault.exe 2876 WerFault.exe 2876 WerFault.exe 2876 WerFault.exe 2876 WerFault.exe 2876 WerFault.exe 2876 WerFault.exe 2876 WerFault.exe 2876 WerFault.exe 4004 WerFault.exe 4004 WerFault.exe 4004 WerFault.exe 4004 WerFault.exe 4004 WerFault.exe 4004 WerFault.exe 4004 WerFault.exe 4004 WerFault.exe 4004 WerFault.exe 4004 WerFault.exe 4004 WerFault.exe 4004 WerFault.exe 4004 WerFault.exe 4004 WerFault.exe 196 WerFault.exe 196 WerFault.exe 196 WerFault.exe 196 WerFault.exe 196 WerFault.exe 196 WerFault.exe 196 WerFault.exe 196 WerFault.exe 196 WerFault.exe 196 WerFault.exe 196 WerFault.exe 196 WerFault.exe 196 WerFault.exe 196 WerFault.exe 1948 WerFault.exe 1948 WerFault.exe 1948 WerFault.exe 1948 WerFault.exe 1948 WerFault.exe 1948 WerFault.exe 1948 WerFault.exe 1948 WerFault.exe 1948 WerFault.exe 1948 WerFault.exe 1948 WerFault.exe 1948 WerFault.exe 1948 WerFault.exe 1948 WerFault.exe 2172 WerFault.exe 2172 WerFault.exe 2172 WerFault.exe 2172 WerFault.exe 2172 WerFault.exe 2172 WerFault.exe 2172 WerFault.exe 2172 WerFault.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeRestorePrivilege 2876 WerFault.exe Token: SeBackupPrivilege 2876 WerFault.exe Token: SeDebugPrivilege 2876 WerFault.exe Token: SeDebugPrivilege 4004 WerFault.exe Token: SeDebugPrivilege 196 WerFault.exe Token: SeDebugPrivilege 1948 WerFault.exe Token: SeDebugPrivilege 2172 WerFault.exe Token: SeDebugPrivilege 1280 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2b8cf09d6dd866faa2ff72c553081ad.exe"C:\Users\Admin\AppData\Local\Temp\a2b8cf09d6dd866faa2ff72c553081ad.exe"1⤵PID:3172
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3172 -s 6602⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2876
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3172 -s 6722⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4004
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3172 -s 8162⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:196
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3172 -s 6762⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1948
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3172 -s 8322⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2172
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3172 -s 8482⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1280
-