982d4ea5fee5b8e551d40cb07272e1bcf707edff1001dd491ac614fdef1fa149 | Triage

Analysis

max time kernel
78s
max time network
125s
platform
windows10_x64
resource
win10-en-20211208
submitted
14-01-2022 13:08

Sharing

Report Analysis Logs

General

Target

982d4ea5fee5b8e551d40cb07272e1bcf707edff1001d.exe
Size

3.4MB
MD5

c7f9efb09db59923b3f96fd1ef2f0873
SHA1

43ee2579fef8ff0c3a5d53f3dc4306bbdf04d484
SHA256

982d4ea5fee5b8e551d40cb07272e1bcf707edff1001dd491ac614fdef1fa149
SHA512

fd926bc25e61bfee4cb873b15f78556e4f23ddb853babbdd2985dd36386da9185433c4b6624b4dd444ae5121073c4d6861d4161ba9c460be62d2f49f2b999389

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1832 2656 WerFault.exe 982d4ea5fee5b8e551d40cb07272e1bcf707edff1001d.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
1832	WerFault.exe
1832	WerFault.exe
1832	WerFault.exe
1832	WerFault.exe
1832	WerFault.exe
1832	WerFault.exe
1832	WerFault.exe
1832	WerFault.exe
1832	WerFault.exe
1832	WerFault.exe
1832	WerFault.exe
1832	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1832 WerFault.exe
Token: SeBackupPrivilege 1832 WerFault.exe
Token: SeDebugPrivilege 1832 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\982d4ea5fee5b8e551d40cb07272e1bcf707edff1001d.exe
"C:\Users\Admin\AppData\Local\Temp\982d4ea5fee5b8e551d40cb07272e1bcf707edff1001d.exe"
1⤵
PID:2656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 404
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2656-114-0x0000000002730000-0x0000000002790000-memory.dmp

Filesize
384KB

Download