f04284c48276af9850bc4123e255b1eb8f6c146114ace5ff76ed38bba059ebe8 | Triage™

Analysis

max time kernel
121s
max time network
122s
platform
windows10_x64
resource
win10-en-20211208
submitted
22/01/2022, 17:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f04284c48276af9850bc4123e255b1eb8f6c146114ace.exe
Size 3.4MB
Sample220122-vmeezsccb4
SHA256 f04284c48276af9850bc4123e255b1eb8f6c146114ace5ff76ed38bba059ebe8
MD5 95b4da50bdcf98569998f02bf2391f25
SHA1 229b1f2b44118e936b3c89d70f2ef6f1a9d28a5c
SHA512 786a1b8bad837bbc95a49882b1b6ff738c39334b232e716287466ee5ee31261885c12a28cc90f3d495cb92eb39975397228471f9a611b08d6d33da76336c1755
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1348	3760	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1348	WerFault.exe
1348	WerFault.exe
1348	WerFault.exe
1348	WerFault.exe
1348	WerFault.exe
1348	WerFault.exe
1348	WerFault.exe
1348	WerFault.exe
1348	WerFault.exe
1348	WerFault.exe
1348	WerFault.exe
1348	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	1348	WerFault.exe
Token: SeBackupPrivilege	1348	WerFault.exe
Token: SeDebugPrivilege	1348	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\f04284c48276af9850bc4123e255b1eb8f6c146114ace.exe
"C:\Users\Admin\AppData\Local\Temp\f04284c48276af9850bc4123e255b1eb8f6c146114ace.exe"
1⤵
PID:3760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3760 -s 408
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3760-115-0x0000000002710000-0x0000000002770000-memory.dmp

Download