9bd4aaf4c7a7cde7757d7083acba1936909a37709b78f702d5997f18edc2c0c6 | Triage

Analysis

max time kernel
120s
max time network
143s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-01-2022 00:34

Sharing

Report Analysis Logs

General

Target

9bd4aaf4c7a7cde7757d7083acba1936909a37709b78f702d5997f18edc2c0c6.exe
Size

84KB
MD5

b288e307795ed7a4002926e89bc43ae5
SHA1

bb518c52eda7ecd0e498304d227762db61fd7409
SHA256

9bd4aaf4c7a7cde7757d7083acba1936909a37709b78f702d5997f18edc2c0c6
SHA512

f537cf56f0a6c2a6fdb0a9f470a5c57e684bd588a2ce61809069d632fc7a619ce5a740b8f5ddbcb80cc71e7b922670027834fa2388559f96df8779d6cf2caaaa

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3780 3516 WerFault.exe 9bd4aaf4c7a7cde7757d7083acba1936909a37709b78f702d5997f18edc2c0c6.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3780 WerFault.exe
Token: SeBackupPrivilege 3780 WerFault.exe
Token: SeDebugPrivilege 3780 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\9bd4aaf4c7a7cde7757d7083acba1936909a37709b78f702d5997f18edc2c0c6.exe
"C:\Users\Admin\AppData\Local\Temp\9bd4aaf4c7a7cde7757d7083acba1936909a37709b78f702d5997f18edc2c0c6.exe"
1⤵
PID:3516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 272
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...