b0ab6d300a941e64035a489f12d717bedbd631cdb60094aa40aee9e1bffb2b92 | Triage

Analysis

max time kernel
117s
max time network
121s
platform
windows10_x64
resource
win10-en-20211208
submitted
20-12-2021 09:19

Sharing

Report Analysis Logs

General

Target

tmp/b0ab6d300a941e64035a489f12d717bedbd631cdb60094aa40aee9e1bffb2b92.exe
Size

235KB
MD5

44dbd40c248e103e86aeff57f2cb5579
SHA1

130124ad1fc46047d76165ee00a96842c97fbba0
SHA256

b0ab6d300a941e64035a489f12d717bedbd631cdb60094aa40aee9e1bffb2b92
SHA512

100bcff283a831f440d76593e7582d77e44f313b683738f9b0103bea54675292dbaee9849e363bd90dc12f52919f7b38d009e021de8698cbd7569cc6db8d865f

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4108 3544 WerFault.exe b0ab6d300a941e64035a489f12d717bedbd631cdb60094aa40aee9e1bffb2b92.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
4108	WerFault.exe
4108	WerFault.exe
4108	WerFault.exe
4108	WerFault.exe
4108	WerFault.exe
4108	WerFault.exe
4108	WerFault.exe
4108	WerFault.exe
4108	WerFault.exe
4108	WerFault.exe
4108	WerFault.exe
4108	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 4108 WerFault.exe
Token: SeBackupPrivilege 4108 WerFault.exe
Token: SeDebugPrivilege 4108 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\tmp\b0ab6d300a941e64035a489f12d717bedbd631cdb60094aa40aee9e1bffb2b92.exe
"C:\Users\Admin\AppData\Local\Temp\tmp\b0ab6d300a941e64035a489f12d717bedbd631cdb60094aa40aee9e1bffb2b92.exe"
1⤵
PID:3544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 256
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...