e13daf91b48cf5c5e946f6fb1a45788f47257ba661666d41dc4604c7da6d1706 | Triage™

Analysis

max time kernel
161s
max time network
168s
platform
windows10_x64
resource
win10-en-20211208
submitted
24/01/2022, 00:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e13daf91b48cf5c5e946f6fb1a45788f47257ba661666d41dc4604c7da6d1706.exe
Size 166KB
Sample220124-a7eahahad6
SHA256 e13daf91b48cf5c5e946f6fb1a45788f47257ba661666d41dc4604c7da6d1706
MD5 c39b5c825e62e036a4f446fe613a59a7
SHA1 9a162b28203272e0958a1d46b8c87d3b27fd34ab
SHA512 6d0e1ce5f421342d376b2aa5dc2053c3ff751dda3668b083ecaaef5043f1be39eac99b2699500ada4a9f756aeda9ea9f40736567203325cdfdcc1034c5dfa1be
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2856	3796	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2856	WerFault.exe
2856	WerFault.exe
2856	WerFault.exe
2856	WerFault.exe
2856	WerFault.exe
2856	WerFault.exe
2856	WerFault.exe
2856	WerFault.exe
2856	WerFault.exe
2856	WerFault.exe
2856	WerFault.exe
2856	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2856	WerFault.exe
Token: SeBackupPrivilege	2856	WerFault.exe
Token: SeDebugPrivilege	2856	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\e13daf91b48cf5c5e946f6fb1a45788f47257ba661666d41dc4604c7da6d1706.exe
"C:\Users\Admin\AppData\Local\Temp\e13daf91b48cf5c5e946f6fb1a45788f47257ba661666d41dc4604c7da6d1706.exe"
1⤵
PID:3796
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 232
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads