b876b5e601fed0f5556000c087f89851ce5336efae776aa3c488bec357a2725b | Triage

Analysis

max time kernel
127s
max time network
180s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-01-2022 01:13

Sharing

Report Analysis Logs

General

Target

b876b5e601fed0f5556000c087f89851ce5336efae776aa3c488bec357a2725b.exe
Size

164KB
MD5

0f0d273b0864a0456752d5956122aa0e
SHA1

db55da2eb644636ec85657ead3eb85175370aa1f
SHA256

b876b5e601fed0f5556000c087f89851ce5336efae776aa3c488bec357a2725b
SHA512

a0899c4161d122a1092d81436f75cc9d909ce67fe37c78d018b84fa46d4600a0b2bd47f85192da12014bf0969eee2ff3c113fb8e872bb574a12afdbb0b8ef45b

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

852 2708 WerFault.exe b876b5e601fed0f5556000c087f89851ce5336efae776aa3c488bec357a2725b.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
852	WerFault.exe
852	WerFault.exe
852	WerFault.exe
852	WerFault.exe
852	WerFault.exe
852	WerFault.exe
852	WerFault.exe
852	WerFault.exe
852	WerFault.exe
852	WerFault.exe
852	WerFault.exe
852	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 852 WerFault.exe
Token: SeBackupPrivilege 852 WerFault.exe
Token: SeDebugPrivilege 852 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\b876b5e601fed0f5556000c087f89851ce5336efae776aa3c488bec357a2725b.exe
"C:\Users\Admin\AppData\Local\Temp\b876b5e601fed0f5556000c087f89851ce5336efae776aa3c488bec357a2725b.exe"
1⤵
PID:2708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 560
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...