d58433a93fdaaa9e6440f0a2cc3f3b3e63a9b772cf41d797a81e40e88569b84f | Triage

Analysis

max time kernel
77s
max time network
80s
platform
windows10_x64
resource
win10v20210408
submitted
22-09-2021 05:02

Sharing

Report Analysis Logs

General

Target

7ab97624__Jof90vHpV.exe
Size

2.7MB
MD5

7ab9762496e0d7b1349c8172f6d123a2
SHA1

2180880c058d1750a33782f340eb58574dd2e9e9
SHA256

d58433a93fdaaa9e6440f0a2cc3f3b3e63a9b772cf41d797a81e40e88569b84f
SHA512

abc09433846d5a52e975976feffa049a872d84145c6ad4717d6325e06b440b9b0d10bb5957454d061634e2d9e9e3e38e3291b6df9f827035436b8caaad1c0e52

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1016 528 WerFault.exe 7ab97624__Jof90vHpV.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
1016	WerFault.exe
1016	WerFault.exe
1016	WerFault.exe
1016	WerFault.exe
1016	WerFault.exe
1016	WerFault.exe
1016	WerFault.exe
1016	WerFault.exe
1016	WerFault.exe
1016	WerFault.exe
1016	WerFault.exe
1016	WerFault.exe
1016	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1016 WerFault.exe
Token: SeBackupPrivilege 1016 WerFault.exe
Token: SeDebugPrivilege 1016 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\7ab97624__Jof90vHpV.exe
"C:\Users\Admin\AppData\Local\Temp\7ab97624__Jof90vHpV.exe"
1⤵
PID:528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 528 -s 500
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1016

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...