2a9dadad3492687ca909b3233e9f51ff2faeb1f5fd897386ac8b923a038c05d5 | Triage

Analysis

max time kernel
117s
max time network
132s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-01-2022 00:36

Sharing

Report Analysis Logs

General

Target

2a9dadad3492687ca909b3233e9f51ff2faeb1f5fd897386ac8b923a038c05d5.exe
Size

83KB
MD5

e42ac49a9fc4d0aeb156cdb897f4e6eb
SHA1

ff0bd9bdef2b091f322fa1fbf1f1ed04fe8c9a91
SHA256

2a9dadad3492687ca909b3233e9f51ff2faeb1f5fd897386ac8b923a038c05d5
SHA512

6250eec3e7f03a2fbdebf32e730dca0251630248c3f205e82ed8eeb2890aeee1c4269b373e28fb100f35453af0c52803d38934792922c10a156788287dcc0a9e

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3148	2740	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3148	WerFault.exe
3148	WerFault.exe
3148	WerFault.exe
3148	WerFault.exe
3148	WerFault.exe
3148	WerFault.exe
3148	WerFault.exe
3148	WerFault.exe
3148	WerFault.exe
3148	WerFault.exe
3148	WerFault.exe
3148	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3148	WerFault.exe
Token: SeBackupPrivilege	3148	WerFault.exe
Token: SeDebugPrivilege	3148	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2a9dadad3492687ca909b3233e9f51ff2faeb1f5fd897386ac8b923a038c05d5.exe
"C:\Users\Admin\AppData\Local\Temp\2a9dadad3492687ca909b3233e9f51ff2faeb1f5fd897386ac8b923a038c05d5.exe"
1⤵
PID:2740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 144
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3148

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads