9464e92fb69a8424aff287c68131558f2ad34abbcd1351bead55d50acc5efd51 | Triage

Analysis

max time kernel
122s
max time network
144s
platform
windows10_x64
resource
win10-en-20210920
submitted
04-11-2021 10:37

Sharing

Report Analysis Logs

General

Target

IMG_RICHIESTA PREVENTIVO 20210411-00091.PDF(71kb).exe
Size

119KB
MD5

6cd36624c62fdda5bdb90fcd6ab89d73
SHA1

ea9cdd8c3f814bfcd02cb9b5b12a5f914368e60b
SHA256

9464e92fb69a8424aff287c68131558f2ad34abbcd1351bead55d50acc5efd51
SHA512

f8614f3a628e88d2ab07cb70fa08f8f10c5974935247a8fa520e8d8ee8a1daac620938b59053c1a9678c66587c3f838e1506d63f22d68efa64585e471eb54243

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

504 4044 WerFault.exe IMG_RICHIESTA PREVENTIVO 20210411-00091.PDF(71kb).exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe
504	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 504 WerFault.exe
Token: SeBackupPrivilege 504 WerFault.exe
Token: SeDebugPrivilege 504 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\IMG_RICHIESTA PREVENTIVO 20210411-00091.PDF(71kb).exe
"C:\Users\Admin\AppData\Local\Temp\IMG_RICHIESTA PREVENTIVO 20210411-00091.PDF(71kb).exe"
1⤵
PID:4044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 500
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...