433c5a7aaeb52e6d45a21a8e5052c9abd43c27c819a55a4d6778d4ebff59d6a3 | Triage

Analysis

max time kernel
119s
max time network
138s
platform
windows10_x64
resource
win10-en-20211104
submitted
02-12-2021 11:41

Sharing

Report Analysis Logs

General

Target

c40c62b978908e0f5112eee4ae7370fb9c4cc1ed7c90a171be89f6fd8c10b376.exe
Size

852KB
MD5

86a1f254efba0877056e9ba4ab6088aa
SHA1

ce4f54be41334648b23cdfd6337ca4e2756852f6
SHA256

c40c62b978908e0f5112eee4ae7370fb9c4cc1ed7c90a171be89f6fd8c10b376
SHA512

bd591b643503709e5e4f20edaadec9a706881c141bd15ebe93c60e144286d1d73940bc69cb421c2ae1e9bfad35c22561aad924c4b89dd4d0154b522eb73836be

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2432 3468 WerFault.exe c40c62b978908e0f5112eee4ae7370fb9c4cc1ed7c90a171be89f6fd8c10b376.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
2432	WerFault.exe
2432	WerFault.exe
2432	WerFault.exe
2432	WerFault.exe
2432	WerFault.exe
2432	WerFault.exe
2432	WerFault.exe
2432	WerFault.exe
2432	WerFault.exe
2432	WerFault.exe
2432	WerFault.exe
2432	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2432 WerFault.exe
Token: SeBackupPrivilege 2432 WerFault.exe
Token: SeDebugPrivilege 2432 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\c40c62b978908e0f5112eee4ae7370fb9c4cc1ed7c90a171be89f6fd8c10b376.exe
"C:\Users\Admin\AppData\Local\Temp\c40c62b978908e0f5112eee4ae7370fb9c4cc1ed7c90a171be89f6fd8c10b376.exe"
1⤵
PID:3468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3468 -s 1656
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...