6217660fe11127132c6c3408e2b8980181a1074cfedb39290deb945610f612a9 | Triage

Analysis

max time kernel
106s
max time network
123s
platform
windows10_x64
resource
win10-en-20211104
submitted
25-11-2021 16:19

Sharing

Report Analysis Logs

General

Target

pag. Grasso. prof. 21414969.exe
Size

497KB
MD5

692908f10464b82d0510ef2383aa9a32
SHA1

2ba285a22ae7ab864cba4f9267ad4709328d6445
SHA256

6217660fe11127132c6c3408e2b8980181a1074cfedb39290deb945610f612a9
SHA512

1cda86749eeb1c683272120a3bffa4e884c399e923c7145c3a99309e65c25b01adfe555abaf453668046753b18c2aada0214feff6045770d5dec634dd2bb0067

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3660 2380 WerFault.exe pag. Grasso. prof. 21414969.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
3660	WerFault.exe
3660	WerFault.exe
3660	WerFault.exe
3660	WerFault.exe
3660	WerFault.exe
3660	WerFault.exe
3660	WerFault.exe
3660	WerFault.exe
3660	WerFault.exe
3660	WerFault.exe
3660	WerFault.exe
3660	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3660 WerFault.exe
Token: SeBackupPrivilege 3660 WerFault.exe
Token: SeDebugPrivilege 3660 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\pag. Grasso. prof. 21414969.exe
"C:\Users\Admin\AppData\Local\Temp\pag. Grasso. prof. 21414969.exe"
1⤵
PID:2380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 1044
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2380-118-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/2380-120-0x0000000004A20000-0x0000000004A21000-memory.dmp

Filesize
4KB

Download