e389b2a5f4a03f387922cbc7cd21a489b332d956461f21a24e1bf15bbc74fa03 | Triage

Analysis

max time kernel
120s
max time network
161s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-01-2022 00:49

Sharing

Report Analysis Logs

General

Target

e389b2a5f4a03f387922cbc7cd21a489b332d956461f21a24e1bf15bbc74fa03.exe
Size

176KB
MD5

390616521c4a8fad53c5524ce1d637c0
SHA1

d8f29633c4843d09361f5d7135c73664aa83f13b
SHA256

e389b2a5f4a03f387922cbc7cd21a489b332d956461f21a24e1bf15bbc74fa03
SHA512

6afe9e4d98aa9bd4addaeac33476a2f8b82d37b58fc1a9a1db1b3e4439671df0cf75632a1752c45b7ac061a356425cfce3b86c8459b1708c48471d581fb4b7e0

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3092 3052 WerFault.exe e389b2a5f4a03f387922cbc7cd21a489b332d956461f21a24e1bf15bbc74fa03.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
3092	WerFault.exe
3092	WerFault.exe
3092	WerFault.exe
3092	WerFault.exe
3092	WerFault.exe
3092	WerFault.exe
3092	WerFault.exe
3092	WerFault.exe
3092	WerFault.exe
3092	WerFault.exe
3092	WerFault.exe
3092	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3092 WerFault.exe
Token: SeBackupPrivilege 3092 WerFault.exe
Token: SeDebugPrivilege 3092 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\e389b2a5f4a03f387922cbc7cd21a489b332d956461f21a24e1bf15bbc74fa03.exe
"C:\Users\Admin\AppData\Local\Temp\e389b2a5f4a03f387922cbc7cd21a489b332d956461f21a24e1bf15bbc74fa03.exe"
1⤵
PID:3052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 236
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3092

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...