92d7103a25d3b2ec6604df41ed3d1ae96e73411d6b7cbaedd3bc28935d6ac4ff | Triage™

Analysis

max time kernel
117s
max time network
147s
platform
windows10_x64
resource
win10-en-20211208
submitted
24/12/2021, 23:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ce90dda33442e187f2ff5ad184d05a9b.exe
Size 853KB
Sample211224-3nar7aeebj
SHA256 92d7103a25d3b2ec6604df41ed3d1ae96e73411d6b7cbaedd3bc28935d6ac4ff
MD5 ce90dda33442e187f2ff5ad184d05a9b
SHA1 89b1d3a3b02bbfe2a65b08a57408b42a7f6a0602
SHA512 e6dda4131f31173de86129f36eabc8ceaddc75cf7d2862ba22a79f1480289ee8fe6e8bb92fc9a3ee0d17f244ef835d55b54a00138466e2fd7e9f399114910ba9
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
804	2324	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
804	WerFault.exe
804	WerFault.exe
804	WerFault.exe
804	WerFault.exe
804	WerFault.exe
804	WerFault.exe
804	WerFault.exe
804	WerFault.exe
804	WerFault.exe
804	WerFault.exe
804	WerFault.exe
804	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	804	WerFault.exe
Token: SeBackupPrivilege	804	WerFault.exe
Token: SeDebugPrivilege	804	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ce90dda33442e187f2ff5ad184d05a9b.exe
"C:\Users\Admin\AppData\Local\Temp\ce90dda33442e187f2ff5ad184d05a9b.exe"
1⤵
PID:2324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 404
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2324-115-0x00000000022F0000-0x0000000002350000-memory.dmp

Download