General
Target

3020-116-0x0000000000400000-0x0000000000414000-memory.dmp.exe

Filesize

80KB

Completed

01-12-2021 18:27

Task

behavioral4

Score
3/10
MD5

01408ac403b5c33f965f650534f81a90

SHA1

a1a23e1978fd58c9189817cca50163b06618b3bf

SHA256

f6b73646a1f1e97dacae54aa9a294eb12c19a3fe5c4ed578787b55eaac3c8ac9

SHA256

add8587516e42cced4466497322026408b6fe10a24c2c78feaf03210879a02b5ca92193e69ec5b445da485246872854a0d966373b9963b1a5adfac5834134404

Malware Config
Signatures 3

Filter: none

  • Program crash
    WerFault.exe

    Reported IOCs

    pidpid_targetprocesstarget process
    41604384WerFault.exe3020-116-0x0000000000400000-0x0000000000414000-memory.dmp.exe
  • Suspicious behavior: EnumeratesProcesses
    WerFault.exe

    Reported IOCs

    pidprocess
    4160WerFault.exe
    4160WerFault.exe
    4160WerFault.exe
    4160WerFault.exe
    4160WerFault.exe
    4160WerFault.exe
    4160WerFault.exe
    4160WerFault.exe
    4160WerFault.exe
    4160WerFault.exe
    4160WerFault.exe
    4160WerFault.exe
  • Suspicious use of AdjustPrivilegeToken
    WerFault.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeRestorePrivilege4160WerFault.exe
    Token: SeBackupPrivilege4160WerFault.exe
    Token: SeDebugPrivilege4160WerFault.exe
Processes 2
  • C:\Users\Admin\AppData\Local\Temp\3020-116-0x0000000000400000-0x0000000000414000-memory.dmp.exe
    "C:\Users\Admin\AppData\Local\Temp\3020-116-0x0000000000400000-0x0000000000414000-memory.dmp.exe"
    PID:4384
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4384 -s 220
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4160
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads