1d11f91a37abb643a3dd3548b2c5f78832d64ff47794064ce2bf4c522669a692 | Triage

Analysis

max time kernel
114s
max time network
122s
platform
windows10_x64
resource
win10-en-20211208
submitted
29-12-2021 10:55

Sharing

Report Analysis Logs

General

Target

cmd.exe_dump.bin.exe
Size

172KB
MD5

6d3c5450a02d07214982ca0d6a881384
SHA1

f23cc12bb21eeaf1b02958f85676122d092bf3d6
SHA256

1d11f91a37abb643a3dd3548b2c5f78832d64ff47794064ce2bf4c522669a692
SHA512

5bc65b12408244090fc0fbad0676862ab6315cb04a13ecf8671eec6bb36576fe1f0db6a2fae2d143177aca1017e5efecbe3622c137f131fb2ea59e67960e5297

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4024	1852	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4024	WerFault.exe
4024	WerFault.exe
4024	WerFault.exe
4024	WerFault.exe
4024	WerFault.exe
4024	WerFault.exe
4024	WerFault.exe
4024	WerFault.exe
4024	WerFault.exe
4024	WerFault.exe
4024	WerFault.exe
4024	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	4024	WerFault.exe
Token: SeBackupPrivilege	4024	WerFault.exe
Token: SeDebugPrivilege	4024	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\cmd.exe_dump.bin.exe
"C:\Users\Admin\AppData\Local\Temp\cmd.exe_dump.bin.exe"
1⤵
PID:1852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 220
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads