fb61dbe2b7c557b773462c56c7787fbe682ea5ff659bd3ce38a3fb779f66f02b | Triage

Analysis

max time kernel
156s
max time network
184s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-01-2022 00:40

Sharing

Report Analysis Logs

General

Target

fb61dbe2b7c557b773462c56c7787fbe682ea5ff659bd3ce38a3fb779f66f02b.exe
Size

139KB
MD5

e593252c2de2d17c81a4b4e8b870dbc4
SHA1

8d9ce65aa7fd29e2fb10ac74a80ec8c39e645e29
SHA256

fb61dbe2b7c557b773462c56c7787fbe682ea5ff659bd3ce38a3fb779f66f02b
SHA512

983f09fa24a802ea60003472b6038ce85c8bf0085880a14a08ad0f7388a052eef5a9c7ee42e5ed7819af191e03b69944071142b8e0087404765c5f6d51351a2f

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4304 3532 WerFault.exe fb61dbe2b7c557b773462c56c7787fbe682ea5ff659bd3ce38a3fb779f66f02b.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
4304	WerFault.exe
4304	WerFault.exe
4304	WerFault.exe
4304	WerFault.exe
4304	WerFault.exe
4304	WerFault.exe
4304	WerFault.exe
4304	WerFault.exe
4304	WerFault.exe
4304	WerFault.exe
4304	WerFault.exe
4304	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 4304 WerFault.exe
Token: SeBackupPrivilege 4304 WerFault.exe
Token: SeDebugPrivilege 4304 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\fb61dbe2b7c557b773462c56c7787fbe682ea5ff659bd3ce38a3fb779f66f02b.exe
"C:\Users\Admin\AppData\Local\Temp\fb61dbe2b7c557b773462c56c7787fbe682ea5ff659bd3ce38a3fb779f66f02b.exe"
1⤵
PID:3532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 564
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4304

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...