ff96c1b6af7f067e0ffe1d90c7d91dd39ac01f22ebb7868eb54f2d414951a728 | Triage™

Analysis

max time kernel
121s
max time network
122s
platform
windows10_x64
resource
win10-en-20211208
submitted
21/12/2021, 01:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
eb34833c39d751ce92ac320a98b09878.exe
Size 4.2MB
Sample211221-bl9d7acbb6
SHA256 ff96c1b6af7f067e0ffe1d90c7d91dd39ac01f22ebb7868eb54f2d414951a728
MD5 eb34833c39d751ce92ac320a98b09878
SHA1 031490184d6b89a34694d96da62fe050da918397
SHA512 ceef3692d3e2c4989b5ed79458df7a4c20547dda2a0a64a7971b871f8e25b2fc40a83895091a3155eb8dd173443d5854141a134609e262f836579248b9a4059e
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
680	3800	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
680	WerFault.exe
680	WerFault.exe
680	WerFault.exe
680	WerFault.exe
680	WerFault.exe
680	WerFault.exe
680	WerFault.exe
680	WerFault.exe
680	WerFault.exe
680	WerFault.exe
680	WerFault.exe
680	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	680	WerFault.exe
Token: SeBackupPrivilege	680	WerFault.exe
Token: SeDebugPrivilege	680	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\eb34833c39d751ce92ac320a98b09878.exe
"C:\Users\Admin\AppData\Local\Temp\eb34833c39d751ce92ac320a98b09878.exe"
1⤵
PID:3800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 404
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3800-114-0x0000000002690000-0x00000000026F0000-memory.dmp

Download