a949023db784c4bbd82a2ce3d6957a457efb81dae684dd92bfd3b7fce3b8f679 | Triage

Analysis

max time kernel
125s
max time network
137s
platform
windows10_x64
resource
win10-en-20211104
submitted
17-11-2021 16:43

Sharing

Report Analysis Logs

General

Target

Fate.Client.dll
Size

97KB
MD5

5705ccb66070bc51c725a307518d5794
SHA1

f3c2d1fa1c238052c5e926d406c32081931b4aad
SHA256

d835bb2d1a3a6df132dee97de30358ad2853fd1b3f329c7d8eb2090c59b30828
SHA512

f53429d9a1ad0716de99ecdcfa551d9bec4a92c401cc7cf525f31d74951e32045d4e1f968dfa77189106a2eae267d4c4d238ccc6892f0fa2dabaf6135c5edde1

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4232 2124 WerFault.exe rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
4232	WerFault.exe
4232	WerFault.exe
4232	WerFault.exe
4232	WerFault.exe
4232	WerFault.exe
4232	WerFault.exe
4232	WerFault.exe
4232	WerFault.exe
4232	WerFault.exe
4232	WerFault.exe
4232	WerFault.exe
4232	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 4232 WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Fate.Client.dll,#1
1⤵
PID:2124

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2124 -s 400
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4232

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...