a9eb984c9de2d2d061babaaec8c15a04895af2cc0653d044f7092ba73013da5b | Triage™

Analysis

max time kernel
119s
max time network
122s
platform
windows10_x64
resource
win10-en-20211208
submitted
29/12/2021, 09:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
03817805450fd55be0025f31ae69399e.exe
Size 4.2MB
Sample211229-lkyleadcdr
SHA256 a9eb984c9de2d2d061babaaec8c15a04895af2cc0653d044f7092ba73013da5b
MD5 03817805450fd55be0025f31ae69399e
SHA1 77e96bd58ec428cc14b1dc051f8a0195d4aec44b
SHA512 42c74059e3898589abd7bedfe3f176e620bf54264926a9449f83067c130ee1f5ffe00264cface35f87506a9c29cc8315dd938110831a0ad6d0fd528e54aa5321
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1876	2728	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1876	WerFault.exe
1876	WerFault.exe
1876	WerFault.exe
1876	WerFault.exe
1876	WerFault.exe
1876	WerFault.exe
1876	WerFault.exe
1876	WerFault.exe
1876	WerFault.exe
1876	WerFault.exe
1876	WerFault.exe
1876	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	1876	WerFault.exe
Token: SeBackupPrivilege	1876	WerFault.exe
Token: SeDebugPrivilege	1876	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\03817805450fd55be0025f31ae69399e.exe
"C:\Users\Admin\AppData\Local\Temp\03817805450fd55be0025f31ae69399e.exe"
1⤵
PID:2728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 404
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2728-115-0x00000000028D0000-0x0000000002930000-memory.dmp

Download