2a9dadad3492687ca909b3233e9f51ff2faeb1f5fd897386ac8b923a038c05d5 | Triage

Analysis

max time kernel
117s
max time network
132s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-01-2022 00:36

Sharing

Report Analysis Logs

General

Target

2a9dadad3492687ca909b3233e9f51ff2faeb1f5fd897386ac8b923a038c05d5.exe
Size

83KB
MD5

e42ac49a9fc4d0aeb156cdb897f4e6eb
SHA1

ff0bd9bdef2b091f322fa1fbf1f1ed04fe8c9a91
SHA256

2a9dadad3492687ca909b3233e9f51ff2faeb1f5fd897386ac8b923a038c05d5
SHA512

6250eec3e7f03a2fbdebf32e730dca0251630248c3f205e82ed8eeb2890aeee1c4269b373e28fb100f35453af0c52803d38934792922c10a156788287dcc0a9e

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3148 2740 WerFault.exe 2a9dadad3492687ca909b3233e9f51ff2faeb1f5fd897386ac8b923a038c05d5.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
3148	WerFault.exe
3148	WerFault.exe
3148	WerFault.exe
3148	WerFault.exe
3148	WerFault.exe
3148	WerFault.exe
3148	WerFault.exe
3148	WerFault.exe
3148	WerFault.exe
3148	WerFault.exe
3148	WerFault.exe
3148	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3148 WerFault.exe
Token: SeBackupPrivilege 3148 WerFault.exe
Token: SeDebugPrivilege 3148 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2a9dadad3492687ca909b3233e9f51ff2faeb1f5fd897386ac8b923a038c05d5.exe
"C:\Users\Admin\AppData\Local\Temp\2a9dadad3492687ca909b3233e9f51ff2faeb1f5fd897386ac8b923a038c05d5.exe"
1⤵
PID:2740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 144
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3148

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...