e847177037dc0ee3f1b92bfd3ee5294786998c4e151ba63727e8f3bd7c41aaaa | Triage™

Analysis

max time kernel
120s
max time network
125s
platform
windows10_x64
resource
win10-en-20211208
submitted
23/12/2021, 07:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
efa9b0bed7de70cdd1216c18aaf35352.exe
Size 492KB
Sample211223-jlehtaaaar
SHA256 e847177037dc0ee3f1b92bfd3ee5294786998c4e151ba63727e8f3bd7c41aaaa
MD5 efa9b0bed7de70cdd1216c18aaf35352
SHA1 34e7d70f624b81312b129983055f1e0de3a65e4d
SHA512 27630e13d9c0436e5eced4ffe2a00f5692ca2911f224bd25a21f48e28e9b7474cd947ceb367eb214111852349f7c22fcfe496f26b2c4e856d1549756ff57263f
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3672	3404	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3672	WerFault.exe
3672	WerFault.exe
3672	WerFault.exe
3672	WerFault.exe
3672	WerFault.exe
3672	WerFault.exe
3672	WerFault.exe
3672	WerFault.exe
3672	WerFault.exe
3672	WerFault.exe
3672	WerFault.exe
3672	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3672	WerFault.exe
Token: SeBackupPrivilege	3672	WerFault.exe
Token: SeDebugPrivilege	3672	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\efa9b0bed7de70cdd1216c18aaf35352.exe
"C:\Users\Admin\AppData\Local\Temp\efa9b0bed7de70cdd1216c18aaf35352.exe"
1⤵
PID:3404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 400
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3404-115-0x00000000021A0000-0x0000000002200000-memory.dmp

Download