dcb148690e2f017e5f28ab200dc2772c50be55de48ac9ec96469931b42bf6e1a | Triage

Analysis

max time kernel
66s
max time network
155s
platform
windows10_x64
resource
win10v20210408
submitted
24-09-2021 03:04

Sharing

Report Analysis Logs

General

Target

docs image screenshot.scr
Size

263KB
MD5

7de03d8fae8732ac9dc5cdc70f8c98a3
SHA1

42524a6c409752fad843fa87a86e858e311af607
SHA256

7058bb27087ef6cfdd8e41e3e8aab66ed8a97d2be116cb0ed8acec7799446e59
SHA512

69b5294261c34c36035406de5a1463d12383c468a7f39ceb8405c11ec248ef5293ac65393d7c1a37917b6c3c8cd150363982ec4e958c10146596c00d5207c4ff

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 356 created 632 356 WerFault.exe docs image screenshot.scr
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

356 632 WerFault.exe docs image screenshot.scr

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
356	WerFault.exe
356	WerFault.exe
356	WerFault.exe
356	WerFault.exe
356	WerFault.exe
356	WerFault.exe
356	WerFault.exe
356	WerFault.exe
356	WerFault.exe
356	WerFault.exe
356	WerFault.exe
356	WerFault.exe
356	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 356 WerFault.exe
Token: SeBackupPrivilege 356 WerFault.exe
Token: SeDebugPrivilege 356 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\docs image screenshot.scr
"C:\Users\Admin\AppData\Local\Temp\docs image screenshot.scr" /S
1⤵
PID:632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 632 -s 264
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/632-114-0x0000000000520000-0x000000000066A000-memory.dmp

Filesize
1.3MB

Download