ac0ad304ab1e7320f73c544f59addcd0140f15e7b55cf81a9c5a72908a9657d2 | Triage

Analysis

max time kernel
120s
max time network
151s
platform
windows10_x64
resource
win10-en-20210920
submitted
26-09-2021 12:40

Sharing

Report Analysis Logs

General

Target

ac0ad304ab1e7320f73c544f59addcd0140f15e7b55cf81a9c5a72908a9657d2.exe
Size

69KB
MD5

ad8486d833e43c854bdcfc46cad06eca
SHA1

12c4b312e4c67bc31d6147dd40de1a0dae353821
SHA256

ac0ad304ab1e7320f73c544f59addcd0140f15e7b55cf81a9c5a72908a9657d2
SHA512

28c50d73b738c2803880c6ca2f7fbc22152949e5b3d0684933ce90a71196be99a2365cb229a0d02b3e56ef4c2ee0bef1b9ac60f08fab32ab72771d8c5d01a9b7

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2552 2064 WerFault.exe ac0ad304ab1e7320f73c544f59addcd0140f15e7b55cf81a9c5a72908a9657d2.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
2552	WerFault.exe
2552	WerFault.exe
2552	WerFault.exe
2552	WerFault.exe
2552	WerFault.exe
2552	WerFault.exe
2552	WerFault.exe
2552	WerFault.exe
2552	WerFault.exe
2552	WerFault.exe
2552	WerFault.exe
2552	WerFault.exe
2552	WerFault.exe
2552	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 2552 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ac0ad304ab1e7320f73c544f59addcd0140f15e7b55cf81a9c5a72908a9657d2.exe
"C:\Users\Admin\AppData\Local\Temp\ac0ad304ab1e7320f73c544f59addcd0140f15e7b55cf81a9c5a72908a9657d2.exe"
1⤵
PID:2064

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2064 -s 744
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2552

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2064-115-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/2064-117-0x0000000000F50000-0x0000000000F51000-memory.dmp

Filesize
4KB

Download