dcb148690e2f017e5f28ab200dc2772c50be55de48ac9ec96469931b42bf6e1a | Triage

Analysis

max time kernel
114s
max time network
152s
platform
windows10_x64
resource
win10-en-20210920
submitted
24-09-2021 07:12

Sharing

Report Analysis Logs

General

Target

docs image screenshot.scr
Size

263KB
MD5

7de03d8fae8732ac9dc5cdc70f8c98a3
SHA1

42524a6c409752fad843fa87a86e858e311af607
SHA256

7058bb27087ef6cfdd8e41e3e8aab66ed8a97d2be116cb0ed8acec7799446e59
SHA512

69b5294261c34c36035406de5a1463d12383c468a7f39ceb8405c11ec248ef5293ac65393d7c1a37917b6c3c8cd150363982ec4e958c10146596c00d5207c4ff

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 3684 created 2668 3684 WerFault.exe docs image screenshot.scr
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3684 2668 WerFault.exe docs image screenshot.scr

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3684 WerFault.exe
Token: SeBackupPrivilege 3684 WerFault.exe
Token: SeDebugPrivilege 3684 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\docs image screenshot.scr
"C:\Users\Admin\AppData\Local\Temp\docs image screenshot.scr" /S
1⤵
PID:2668
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 264
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2668-115-0x00000000004D0000-0x000000000061A000-memory.dmp

Filesize
1.3MB

Download