d44c3c6ee94ab3fed02116b3957376e85b72b838af6d057205cdc93fce295e48 | Triage

Analysis

max time kernel
164s
max time network
181s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-01-2022 00:58

Sharing

Report Analysis Logs

General

Target

d44c3c6ee94ab3fed02116b3957376e85b72b838af6d057205cdc93fce295e48.exe
Size

161KB
MD5

1c6e9d940963410d1ed4ddecafd49f8f
SHA1

5e5d7c7595c60a03858b2285b06ba26e963b9525
SHA256

d44c3c6ee94ab3fed02116b3957376e85b72b838af6d057205cdc93fce295e48
SHA512

bbaa603c843c17fabccc987c4aada4e84e0f55680863b20b18565c2dbc81ad59acda359903e8b62408331a4bea55252aacb239699f168079cd356a8b328e7ad3

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1180 2480 WerFault.exe d44c3c6ee94ab3fed02116b3957376e85b72b838af6d057205cdc93fce295e48.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1180 WerFault.exe
Token: SeBackupPrivilege 1180 WerFault.exe
Token: SeDebugPrivilege 1180 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\d44c3c6ee94ab3fed02116b3957376e85b72b838af6d057205cdc93fce295e48.exe
"C:\Users\Admin\AppData\Local\Temp\d44c3c6ee94ab3fed02116b3957376e85b72b838af6d057205cdc93fce295e48.exe"
1⤵
PID:2480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 236
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1180

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...