734aeb2b1d39b542302840ec714d5f03de1e0b228f7119bf7111a1dd4877c2ab | Triage

Analysis

max time kernel
169s
max time network
180s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-01-2022 01:49

Sharing

Report Analysis Logs

General

Target

734aeb2b1d39b542302840ec714d5f03de1e0b228f7119bf7111a1dd4877c2ab.exe
Size

166KB
MD5

aecb85375f695db3a3c76ecb161bc30d
SHA1

5e63fb508251e7f0376fb24108a39dc8416e6132
SHA256

734aeb2b1d39b542302840ec714d5f03de1e0b228f7119bf7111a1dd4877c2ab
SHA512

010c61ed3f6582f2591b4fcad98f955c4e91e2facaf4bf321368007a536f4adf0bfcc51ec67fa04022f03072f39c394a7c5a74c1d27f346b3d8c01bcbd8e9fbe

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2220 512 WerFault.exe 734aeb2b1d39b542302840ec714d5f03de1e0b228f7119bf7111a1dd4877c2ab.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
2220	WerFault.exe
2220	WerFault.exe
2220	WerFault.exe
2220	WerFault.exe
2220	WerFault.exe
2220	WerFault.exe
2220	WerFault.exe
2220	WerFault.exe
2220	WerFault.exe
2220	WerFault.exe
2220	WerFault.exe
2220	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2220 WerFault.exe
Token: SeBackupPrivilege 2220 WerFault.exe
Token: SeDebugPrivilege 2220 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\734aeb2b1d39b542302840ec714d5f03de1e0b228f7119bf7111a1dd4877c2ab.exe
"C:\Users\Admin\AppData\Local\Temp\734aeb2b1d39b542302840ec714d5f03de1e0b228f7119bf7111a1dd4877c2ab.exe"
1⤵
PID:512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 512 -s 232
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...