05a0f7012de4482c552ffef69727209731444449357282ff49037f36503fbfa9 | Triage™

Analysis

max time kernel
119s
max time network
124s
platform
windows10_x64
resource
win10-en-20211104
submitted
15/11/2021, 12:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
05a0f7012de4482c552ffef6972720973144444935728.exe
Size 4.2MB
Sample211115-pqmb4sfabl
SHA256 05a0f7012de4482c552ffef69727209731444449357282ff49037f36503fbfa9
MD5 e42d69acb75be7780874c9ea58e4aa46
SHA1 04cb30a014d50db1e5fc438cd17c8b3c97d2c3f6
SHA512 36a7d5675bb3605be7800f398916a9ecd4026a954c3d842452e0435b14d912e379a3c265072cdd5a4336be164de8b2197d2ef837bdabd3cee2b492342d84ee87
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2320	3348	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2320	WerFault.exe
2320	WerFault.exe
2320	WerFault.exe
2320	WerFault.exe
2320	WerFault.exe
2320	WerFault.exe
2320	WerFault.exe
2320	WerFault.exe
2320	WerFault.exe
2320	WerFault.exe
2320	WerFault.exe
2320	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2320	WerFault.exe
Token: SeBackupPrivilege	2320	WerFault.exe
Token: SeDebugPrivilege	2320	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\05a0f7012de4482c552ffef6972720973144444935728.exe
"C:\Users\Admin\AppData\Local\Temp\05a0f7012de4482c552ffef6972720973144444935728.exe"
1⤵
PID:3348
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3348 -s 404
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3348-118-0x0000000002760000-0x00000000027C0000-memory.dmp

Download