01e1569c9614d44f66b8f493e36ce90a45da47c0007f6f2d9a36eadf79cc0851 | Triage

Analysis

max time kernel
110s
max time network
123s
platform
windows10_x64
resource
win10-en-20211208
submitted
18-12-2021 02:54

Sharing

Report Analysis Logs

General

Target

01e1569c9614d44f66b8f493e36ce90a45da47c0007f6f2d9a36eadf79cc0851.exe
Size

3.8MB
MD5

fe10a4f29bdb19294e5d23e946f2b41c
SHA1

a20942b2f605342a95a23849195c8974b70ae273
SHA256

01e1569c9614d44f66b8f493e36ce90a45da47c0007f6f2d9a36eadf79cc0851
SHA512

32da7bd6d0dedd540f67818a19efe709fe508ccf282be1c65263589c64162ec9ebb9fdfd9026c24ec1e81e9b48ab533a4d2cf249eb07452ea624427e0fbc4add

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1336 3684 WerFault.exe 01e1569c9614d44f66b8f493e36ce90a45da47c0007f6f2d9a36eadf79cc0851.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
1336	WerFault.exe
1336	WerFault.exe
1336	WerFault.exe
1336	WerFault.exe
1336	WerFault.exe
1336	WerFault.exe
1336	WerFault.exe
1336	WerFault.exe
1336	WerFault.exe
1336	WerFault.exe
1336	WerFault.exe
1336	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1336 WerFault.exe
Token: SeBackupPrivilege 1336 WerFault.exe
Token: SeDebugPrivilege 1336 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\01e1569c9614d44f66b8f493e36ce90a45da47c0007f6f2d9a36eadf79cc0851.exe
"C:\Users\Admin\AppData\Local\Temp\01e1569c9614d44f66b8f493e36ce90a45da47c0007f6f2d9a36eadf79cc0851.exe"
1⤵
PID:3684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3684 -s 508
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...