938248b6428d12e57d4bcad2c36b369599b5eb7687f16c0998ca967d9c8e228c | Triage

Analysis

max time kernel
133s
max time network
154s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-01-2022 01:34

Sharing

Report Analysis Logs

General

Target

938248b6428d12e57d4bcad2c36b369599b5eb7687f16c0998ca967d9c8e228c.exe
Size

160KB
MD5

48213007810cd3dea37b94c06e80059d
SHA1

58abd2f6abe56634204a30f94ddc3c90c8abf686
SHA256

938248b6428d12e57d4bcad2c36b369599b5eb7687f16c0998ca967d9c8e228c
SHA512

7dddc9c3d5f2a334a1b3c72044290e807b7f25f60ef18447888630491e866c4c3502c4df48bc028b2a59dd613686e20ceac500923625a5032a21bb4ee93d0023

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2128 3384 WerFault.exe 938248b6428d12e57d4bcad2c36b369599b5eb7687f16c0998ca967d9c8e228c.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
2128	WerFault.exe
2128	WerFault.exe
2128	WerFault.exe
2128	WerFault.exe
2128	WerFault.exe
2128	WerFault.exe
2128	WerFault.exe
2128	WerFault.exe
2128	WerFault.exe
2128	WerFault.exe
2128	WerFault.exe
2128	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2128 WerFault.exe
Token: SeBackupPrivilege 2128 WerFault.exe
Token: SeDebugPrivilege 2128 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\938248b6428d12e57d4bcad2c36b369599b5eb7687f16c0998ca967d9c8e228c.exe
"C:\Users\Admin\AppData\Local\Temp\938248b6428d12e57d4bcad2c36b369599b5eb7687f16c0998ca967d9c8e228c.exe"
1⤵
PID:3384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3384 -s 232
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2128

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...