9788f5a112da768ac9d6aaf8ba33991f8e738260da19e651684be8390fdac792 | Triage

Analysis

max time kernel
110s
max time network
126s
platform
windows10_x64
resource
win10-en-20210920
submitted
21-10-2021 21:31

Sharing

Report Analysis Logs

General

Target

OL.connect_diagnosis.exe
Size

2.1MB
MD5

2c6b87a223eaf937784c078089da1af0
SHA1

38d546cfdad929133c2e20c772482f0e52e476bb
SHA256

9788f5a112da768ac9d6aaf8ba33991f8e738260da19e651684be8390fdac792
SHA512

a13ff72bb343457ecda83cfe4267ac36e8412f4d9a8be317d13ca03227b62535d0f84ecfeee2027c46923745b6dc13fc02d9de0a5d96677cb416931b56d74992

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 1164 created 2664 1164 WerFault.exe OL.connect_diagnosis.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1164 2664 WerFault.exe OL.connect_diagnosis.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
1164	WerFault.exe
1164	WerFault.exe
1164	WerFault.exe
1164	WerFault.exe
1164	WerFault.exe
1164	WerFault.exe
1164	WerFault.exe
1164	WerFault.exe
1164	WerFault.exe
1164	WerFault.exe
1164	WerFault.exe
1164	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1164 WerFault.exe
Token: SeBackupPrivilege 1164 WerFault.exe
Token: SeDebugPrivilege 1164 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\OL.connect_diagnosis.exe
"C:\Users\Admin\AppData\Local\Temp\OL.connect_diagnosis.exe"
1⤵
PID:2664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 484
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1164

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2664-115-0x0000000001630000-0x000000000177A000-memory.dmp

Filesize
1.3MB

Download