92d531a0fb04b12284407e73bac475258180008fd62febc0a40975f57b19cb84 | Triage

Analysis

max time kernel
154s
max time network
164s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-01-2022 01:34

Sharing

Report Analysis Logs

General

Target

92d531a0fb04b12284407e73bac475258180008fd62febc0a40975f57b19cb84.exe
Size

164KB
MD5

18d6ebbddaf021051b43bd1fbe205069
SHA1

d1f9c3b528c321a476adaa650dea3df1160125f2
SHA256

92d531a0fb04b12284407e73bac475258180008fd62febc0a40975f57b19cb84
SHA512

f27a0a852c3b14516179d51883c58a57293d957de07c0e91664188d769e4fd3329c621f17ceb593055a93751a0dd8889d3cc042d10399dc2187d0682e1a9cb0c

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3668 3820 WerFault.exe 92d531a0fb04b12284407e73bac475258180008fd62febc0a40975f57b19cb84.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
3668	WerFault.exe
3668	WerFault.exe
3668	WerFault.exe
3668	WerFault.exe
3668	WerFault.exe
3668	WerFault.exe
3668	WerFault.exe
3668	WerFault.exe
3668	WerFault.exe
3668	WerFault.exe
3668	WerFault.exe
3668	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3668 WerFault.exe
Token: SeBackupPrivilege 3668 WerFault.exe
Token: SeDebugPrivilege 3668 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\92d531a0fb04b12284407e73bac475258180008fd62febc0a40975f57b19cb84.exe
"C:\Users\Admin\AppData\Local\Temp\92d531a0fb04b12284407e73bac475258180008fd62febc0a40975f57b19cb84.exe"
1⤵
PID:3820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3820 -s 564
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3668

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...