592afc9e2c646761c51097fc49108f8fa6272c27d8f72113d175efe5783372fd | Triage

Analysis

max time kernel
119s
max time network
125s
platform
windows10_x64
resource
win10-en-20211208
submitted
20-12-2021 09:21

Sharing

Report Analysis Logs

General

Target

tmp/592afc9e2c646761c51097fc49108f8fa6272c27d8f72113d175efe5783372fd.exe
Size

235KB
MD5

d0b0c9cae5e6be5d5b09cad366c57c49
SHA1

42e18682d6b37d50a3c763846c14ea4a5bc38d40
SHA256

592afc9e2c646761c51097fc49108f8fa6272c27d8f72113d175efe5783372fd
SHA512

c3704c6e2267a933e291b8c2e57c7934f34e10c8befd76ec1d5d93101b0bb1e63a4d2b681256b929d1f3326ec6951c353d0a9705d61a2bb94ec9723069d5fbe9

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3848 2740 WerFault.exe 592afc9e2c646761c51097fc49108f8fa6272c27d8f72113d175efe5783372fd.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
3848	WerFault.exe
3848	WerFault.exe
3848	WerFault.exe
3848	WerFault.exe
3848	WerFault.exe
3848	WerFault.exe
3848	WerFault.exe
3848	WerFault.exe
3848	WerFault.exe
3848	WerFault.exe
3848	WerFault.exe
3848	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3848 WerFault.exe
Token: SeBackupPrivilege 3848 WerFault.exe
Token: SeDebugPrivilege 3848 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\tmp\592afc9e2c646761c51097fc49108f8fa6272c27d8f72113d175efe5783372fd.exe
"C:\Users\Admin\AppData\Local\Temp\tmp\592afc9e2c646761c51097fc49108f8fa6272c27d8f72113d175efe5783372fd.exe"
1⤵
PID:2740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 244
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...