c78dcc3f8293dda9bb834e07ea4361868fedfebb4db9817c8c9473af4d8f5e46 | Triage

Analysis

max time kernel
123s
max time network
149s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-01-2022 01:05

Sharing

Report Analysis Logs

General

Target

c78dcc3f8293dda9bb834e07ea4361868fedfebb4db9817c8c9473af4d8f5e46.exe
Size

115KB
MD5

93f39b95d6a7e7018e0c29e3eeed70f5
SHA1

f8ffd584a5d0e358243fe175643eae2ce70d685c
SHA256

c78dcc3f8293dda9bb834e07ea4361868fedfebb4db9817c8c9473af4d8f5e46
SHA512

5bf250691b43d9974cfacc6beca8a390d8a4c3bf350369af5b41464b0d973b5b167735924797e8a43a310b4b5e5fe5a4bc4deb630b4d7157a8fcf97d00167a3d

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

368 3068 WerFault.exe c78dcc3f8293dda9bb834e07ea4361868fedfebb4db9817c8c9473af4d8f5e46.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
368	WerFault.exe
368	WerFault.exe
368	WerFault.exe
368	WerFault.exe
368	WerFault.exe
368	WerFault.exe
368	WerFault.exe
368	WerFault.exe
368	WerFault.exe
368	WerFault.exe
368	WerFault.exe
368	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 368 WerFault.exe
Token: SeBackupPrivilege 368 WerFault.exe
Token: SeDebugPrivilege 368 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\c78dcc3f8293dda9bb834e07ea4361868fedfebb4db9817c8c9473af4d8f5e46.exe
"C:\Users\Admin\AppData\Local\Temp\c78dcc3f8293dda9bb834e07ea4361868fedfebb4db9817c8c9473af4d8f5e46.exe"
1⤵
PID:3068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 268
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:368

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...