e2bf9e2c787866d86fc1ae939c378f7d22fab268a00ae163fff1b79332df2088 | Triage

Analysis

max time kernel
149s
max time network
149s
platform
windows10_x64
resource
win10-en-20210920
submitted
27-09-2021 14:03

Sharing

Report Analysis Logs

General

Target

Auftragsbestätigung Dringend.exe
Size

812KB
MD5

b8d99b6c405fc56bd8a1448421d64eac
SHA1

0ba8da5d51a77798010e6b1a2a8e759c8bcbe7fa
SHA256

e2bf9e2c787866d86fc1ae939c378f7d22fab268a00ae163fff1b79332df2088
SHA512

5b1408332ce31003708a5de87bb2b7e3df4731d1d978a3f9dab992a12ccea57ab04239955fd3a56af867fd160ede3d3830826231352bacd0416f887e4e3c070f

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3476 2060 WerFault.exe Auftragsbestätigung Dringend.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3476	WerFault.exe
3476	WerFault.exe
3476	WerFault.exe
3476	WerFault.exe
3476	WerFault.exe
3476	WerFault.exe
3476	WerFault.exe
3476	WerFault.exe
3476	WerFault.exe
3476	WerFault.exe
3476	WerFault.exe
3476	WerFault.exe
3476	WerFault.exe
3476	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3476 WerFault.exe
Token: SeBackupPrivilege 3476 WerFault.exe
Token: SeDebugPrivilege 3476 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Auftragsbestätigung Dringend.exe
"C:\Users\Admin\AppData\Local\Temp\Auftragsbestätigung Dringend.exe"
1⤵
PID:2060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 1728
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3476

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2060-115-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download