ac0ad304ab1e7320f73c544f59addcd0140f15e7b55cf81a9c5a72908a9657d2 | Triage

Analysis

max time kernel
112s
max time network
120s
platform
windows10_x64
resource
win10-en-20210920
submitted
26-09-2021 14:53

Sharing

Report Analysis Logs

General

Target

ad8486d833e43c854bdcfc46cad06eca.exe
Size

69KB
MD5

ad8486d833e43c854bdcfc46cad06eca
SHA1

12c4b312e4c67bc31d6147dd40de1a0dae353821
SHA256

ac0ad304ab1e7320f73c544f59addcd0140f15e7b55cf81a9c5a72908a9657d2
SHA512

28c50d73b738c2803880c6ca2f7fbc22152949e5b3d0684933ce90a71196be99a2365cb229a0d02b3e56ef4c2ee0bef1b9ac60f08fab32ab72771d8c5d01a9b7

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3680 2636 WerFault.exe ad8486d833e43c854bdcfc46cad06eca.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3680	WerFault.exe
3680	WerFault.exe
3680	WerFault.exe
3680	WerFault.exe
3680	WerFault.exe
3680	WerFault.exe
3680	WerFault.exe
3680	WerFault.exe
3680	WerFault.exe
3680	WerFault.exe
3680	WerFault.exe
3680	WerFault.exe
3680	WerFault.exe
3680	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 3680 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ad8486d833e43c854bdcfc46cad06eca.exe
"C:\Users\Admin\AppData\Local\Temp\ad8486d833e43c854bdcfc46cad06eca.exe"
1⤵
PID:2636

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2636 -s 744
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3680

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2636-115-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2636-117-0x00000000022A0000-0x00000000022A1000-memory.dmp

Filesize
4KB

Download