Analysis
- max time kernel
11s - max time network
113s - platform
windows10_x64 - resource
win10v20210410 - submitted
09/08/2021, 02:16
Static task
static1
Behavioral task
behavioral1
Sample
a2b8cf09d6dd866faa2ff72c553081ad.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a2b8cf09d6dd866faa2ff72c553081ad.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target a2b8cf09d6dd866faa2ff72c553081ad.exe
- Size 264KB
- Sample210809-lf385qq7rn
- SHA256 53364173f3b4771f13cf0f8c6d4e19717f9097d3680e62a09d69186cb71001c8
- MD5 a2b8cf09d6dd866faa2ff72c553081ad
- SHA1 955afd9dae7c07f72bc9e3394b0e37de41d3aab3
- SHA512 fdea959e9013a2bad3a70525e7c5bf17b6b42e245044fb39feda72b1e161be119305eecde0d39382e55331ea0bc0fbeb5960b4ec720b7f3cce20674aa667df51
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 3104 created 3036 3104 WerFault.exe 53 - Program crash 5 IoCs
pid pid_target Process procid_target 3648 3036 WerFault.exe 53 3548 3036 WerFault.exe 53 2296 3036 WerFault.exe 53 1356 3036 WerFault.exe 53 3104 3036 WerFault.exe 53 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3648 WerFault.exe 3648 WerFault.exe 3648 WerFault.exe 3648 WerFault.exe 3648 WerFault.exe 3648 WerFault.exe 3648 WerFault.exe 3648 WerFault.exe 3648 WerFault.exe 3648 WerFault.exe 3648 WerFault.exe 3648 WerFault.exe 3648 WerFault.exe 3648 WerFault.exe 3548 WerFault.exe 3548 WerFault.exe 3548 WerFault.exe 3548 WerFault.exe 3548 WerFault.exe 3548 WerFault.exe 3548 WerFault.exe 3548 WerFault.exe 3548 WerFault.exe 3548 WerFault.exe 3548 WerFault.exe 3548 WerFault.exe 3548 WerFault.exe 3548 WerFault.exe 2296 WerFault.exe 2296 WerFault.exe 2296 WerFault.exe 2296 WerFault.exe 2296 WerFault.exe 2296 WerFault.exe 2296 WerFault.exe 2296 WerFault.exe 2296 WerFault.exe 2296 WerFault.exe 2296 WerFault.exe 2296 WerFault.exe 2296 WerFault.exe 2296 WerFault.exe 1356 WerFault.exe 1356 WerFault.exe 1356 WerFault.exe 1356 WerFault.exe 1356 WerFault.exe 1356 WerFault.exe 1356 WerFault.exe 1356 WerFault.exe 1356 WerFault.exe 1356 WerFault.exe 1356 WerFault.exe 1356 WerFault.exe 1356 WerFault.exe 1356 WerFault.exe 3104 WerFault.exe 3104 WerFault.exe 3104 WerFault.exe 3104 WerFault.exe 3104 WerFault.exe 3104 WerFault.exe 3104 WerFault.exe 3104 WerFault.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 3648 WerFault.exe Token: SeBackupPrivilege 3648 WerFault.exe Token: SeDebugPrivilege 3648 WerFault.exe Token: SeDebugPrivilege 3548 WerFault.exe Token: SeDebugPrivilege 2296 WerFault.exe Token: SeDebugPrivilege 1356 WerFault.exe Token: SeDebugPrivilege 3104 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2b8cf09d6dd866faa2ff72c553081ad.exe"C:\Users\Admin\AppData\Local\Temp\a2b8cf09d6dd866faa2ff72c553081ad.exe"1⤵PID:3036
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 6642⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3648
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 7722⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3548
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 7482⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2296
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 8202⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1356
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 8482⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3104
-