dd1c58c48d46cce9ef92a730687f87d97bdb9d9bad51034177543e3833fa7ccb | Triage

Resubmissions

18/11/2021, 12:03

211118-n8hafafhb2 10

08/11/2021, 11:39

211108-nskqmabhf6 10

Analysis

max time kernel
119s
max time network
136s
platform
windows10_x64
resource
win10-en-20211104
submitted
08/11/2021, 11:39

Sharing

Report Analysis Logs

General

Target

dd1c58c48d46cce9ef92a730687f87d97bdb9d9bad51034177543e3833fa7ccb.bin.sample.exe
Size

2.2MB
MD5

91655b3f5566a3a01b4c591b90a1a7f4
SHA1

bf498b3c1a785d5b0a314a222ea6a4580a91ec56
SHA256

dd1c58c48d46cce9ef92a730687f87d97bdb9d9bad51034177543e3833fa7ccb
SHA512

7a3dd004c9bba6b176cd4cb27fec4d06559e53afc858f4e2217ccc60631b7193bb0abefe668a1238ec5b0116008f341c89330c2e5cdeef63bbab867a64e4779d

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
528	3348	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
528	WerFault.exe
528	WerFault.exe
528	WerFault.exe
528	WerFault.exe
528	WerFault.exe
528	WerFault.exe
528	WerFault.exe
528	WerFault.exe
528	WerFault.exe
528	WerFault.exe
528	WerFault.exe
528	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	528	WerFault.exe
Token: SeBackupPrivilege	528	WerFault.exe
Token: SeDebugPrivilege	528	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\dd1c58c48d46cce9ef92a730687f87d97bdb9d9bad51034177543e3833fa7ccb.bin.sample.exe
"C:\Users\Admin\AppData\Local\Temp\dd1c58c48d46cce9ef92a730687f87d97bdb9d9bad51034177543e3833fa7ccb.bin.sample.exe"
1⤵
PID:3348
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3348 -s 240
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads