ff0d99ed61293668c0a81cc3e0ead43d1c7392ac351e34e1219f22a1b671aa72 | Triage

Analysis

max time kernel
113s
max time network
131s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-01-2022 00:38

Sharing

Report Analysis Logs

General

Target

ff0d99ed61293668c0a81cc3e0ead43d1c7392ac351e34e1219f22a1b671aa72.exe
Size

112KB
MD5

c24e1c04cefda3041f4af2398a43ae32
SHA1

15e1a4bbe48616a72445b73abb667ebb0803f98d
SHA256

ff0d99ed61293668c0a81cc3e0ead43d1c7392ac351e34e1219f22a1b671aa72
SHA512

d96ec3e2f9a4208c9ac257da69f143f8b6afa542febde7f871fff7d24413d4b8bb4573fdba4969468791cd7f1e4470907549d1a0b2539e8ff4b9296c40d02d86

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1132 3732 WerFault.exe ff0d99ed61293668c0a81cc3e0ead43d1c7392ac351e34e1219f22a1b671aa72.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
1132	WerFault.exe
1132	WerFault.exe
1132	WerFault.exe
1132	WerFault.exe
1132	WerFault.exe
1132	WerFault.exe
1132	WerFault.exe
1132	WerFault.exe
1132	WerFault.exe
1132	WerFault.exe
1132	WerFault.exe
1132	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1132 WerFault.exe
Token: SeBackupPrivilege 1132 WerFault.exe
Token: SeDebugPrivilege 1132 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ff0d99ed61293668c0a81cc3e0ead43d1c7392ac351e34e1219f22a1b671aa72.exe
"C:\Users\Admin\AppData\Local\Temp\ff0d99ed61293668c0a81cc3e0ead43d1c7392ac351e34e1219f22a1b671aa72.exe"
1⤵
PID:3732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3732 -s 656
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1132

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...