bebc6438f6819983c04582637fa257e24127312d5b1c09bce5ab887d5536c079 | Triage

Analysis

max time kernel
167s
max time network
181s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-01-2022 01:10

Sharing

Report Analysis Logs

General

Target

bebc6438f6819983c04582637fa257e24127312d5b1c09bce5ab887d5536c079.exe
Size

165KB
MD5

40c06ece16e5aded556808835ea1d6a9
SHA1

56e7d4848a76d4ce4563ceaae700ba517ef3e2b0
SHA256

bebc6438f6819983c04582637fa257e24127312d5b1c09bce5ab887d5536c079
SHA512

07f88237c328099bb27ff450924efe1bbff2fdf194b0e1dd85eb3961835e22205a37d6ce878f767d32841ccc0fa3ef1348e14e759cacbd973d1fc5b30720847b

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1392 3564 WerFault.exe bebc6438f6819983c04582637fa257e24127312d5b1c09bce5ab887d5536c079.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
1392	WerFault.exe
1392	WerFault.exe
1392	WerFault.exe
1392	WerFault.exe
1392	WerFault.exe
1392	WerFault.exe
1392	WerFault.exe
1392	WerFault.exe
1392	WerFault.exe
1392	WerFault.exe
1392	WerFault.exe
1392	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1392 WerFault.exe
Token: SeBackupPrivilege 1392 WerFault.exe
Token: SeDebugPrivilege 1392 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\bebc6438f6819983c04582637fa257e24127312d5b1c09bce5ab887d5536c079.exe
"C:\Users\Admin\AppData\Local\Temp\bebc6438f6819983c04582637fa257e24127312d5b1c09bce5ab887d5536c079.exe"
1⤵
PID:3564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 244
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...