d6d65b0ed63744f529fdcc34328d1c3060b01c958957bff31698c928517a55b8 | Triage

Analysis

max time kernel
171s
max time network
182s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-01-2022 00:57

Sharing

Report Analysis Logs

General

Target

d6d65b0ed63744f529fdcc34328d1c3060b01c958957bff31698c928517a55b8.exe
Size

176KB
MD5

756cd4b3506ce470d8b2fa0ef60a3b8e
SHA1

f04310289ce431d40e929de690a56c25d48d77a8
SHA256

d6d65b0ed63744f529fdcc34328d1c3060b01c958957bff31698c928517a55b8
SHA512

699c1d690b7796059ca5c859b86def19a2a72434ee2876d09637798cecd9f176deee16a0e6cd568b9f9e5971b43a4e968d6693c5a9f1a5fe238c6d505d91aa04

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4324 3668 WerFault.exe d6d65b0ed63744f529fdcc34328d1c3060b01c958957bff31698c928517a55b8.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
4324	WerFault.exe
4324	WerFault.exe
4324	WerFault.exe
4324	WerFault.exe
4324	WerFault.exe
4324	WerFault.exe
4324	WerFault.exe
4324	WerFault.exe
4324	WerFault.exe
4324	WerFault.exe
4324	WerFault.exe
4324	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 4324 WerFault.exe
Token: SeBackupPrivilege 4324 WerFault.exe
Token: SeDebugPrivilege 4324 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\d6d65b0ed63744f529fdcc34328d1c3060b01c958957bff31698c928517a55b8.exe
"C:\Users\Admin\AppData\Local\Temp\d6d65b0ed63744f529fdcc34328d1c3060b01c958957bff31698c928517a55b8.exe"
1⤵
PID:3668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3668 -s 240
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4324

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...