9bd4aaf4c7a7cde7757d7083acba1936909a37709b78f702d5997f18edc2c0c6 | Triage

Analysis

max time kernel
120s
max time network
143s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-01-2022 00:34

Sharing

Report Analysis Logs

General

Target

9bd4aaf4c7a7cde7757d7083acba1936909a37709b78f702d5997f18edc2c0c6.exe
Size

84KB
MD5

b288e307795ed7a4002926e89bc43ae5
SHA1

bb518c52eda7ecd0e498304d227762db61fd7409
SHA256

9bd4aaf4c7a7cde7757d7083acba1936909a37709b78f702d5997f18edc2c0c6
SHA512

f537cf56f0a6c2a6fdb0a9f470a5c57e684bd588a2ce61809069d632fc7a619ce5a740b8f5ddbcb80cc71e7b922670027834fa2388559f96df8779d6cf2caaaa

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3780	3516	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe
3780	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3780	WerFault.exe
Token: SeBackupPrivilege	3780	WerFault.exe
Token: SeDebugPrivilege	3780	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\9bd4aaf4c7a7cde7757d7083acba1936909a37709b78f702d5997f18edc2c0c6.exe
"C:\Users\Admin\AppData\Local\Temp\9bd4aaf4c7a7cde7757d7083acba1936909a37709b78f702d5997f18edc2c0c6.exe"
1⤵
PID:3516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 272
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads