675fb06332308b4e20c18722d71d7ac4a4fa3414cf2c93720800f52deb217542 | Triage™

Analysis

max time kernel
117s
max time network
151s
platform
windows10_x64
resource
win10-en-20211208
submitted
24/12/2021, 13:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Auto_Install.exe
Size 851KB
Sample211224-p8nb5aebf4
SHA256 675fb06332308b4e20c18722d71d7ac4a4fa3414cf2c93720800f52deb217542
MD5 1ae9d274e3fb54a3f05afc49b9332fc4
SHA1 2bc7cb74571686c329c4ada949ebc8ac73a629eb
SHA512 083720a326bde9f92d350da20d30864d11ede9c0794787b5ea0a1b2ac05175f4f02a9f72c1c551f1ee87578afaee59a69045a9f2221d14f0bf2d7e34442a36ca
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
804	712	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
804	WerFault.exe
804	WerFault.exe
804	WerFault.exe
804	WerFault.exe
804	WerFault.exe
804	WerFault.exe
804	WerFault.exe
804	WerFault.exe
804	WerFault.exe
804	WerFault.exe
804	WerFault.exe
804	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	804	WerFault.exe
Token: SeBackupPrivilege	804	WerFault.exe
Token: SeDebugPrivilege	804	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Auto_Install.exe
"C:\Users\Admin\AppData\Local\Temp\Auto_Install.exe"
1⤵
PID:712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 712 -s 404
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/712-115-0x00000000022E0000-0x0000000002340000-memory.dmp

Download