3fc734a086c8d3aba757aa147a8d46a317e47bb0372f1fb2abf0a163a5d2938b | Triage

Analysis

max time kernel
130s
max time network
139s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-01-2022 02:13

Sharing

Report Analysis Logs

General

Target

3fc734a086c8d3aba757aa147a8d46a317e47bb0372f1fb2abf0a163a5d2938b.exe
Size

165KB
MD5

02b3f1d1606d2698cae94764d2ddafe8
SHA1

a89709026d78845a0feba76bb61789da21d9a821
SHA256

3fc734a086c8d3aba757aa147a8d46a317e47bb0372f1fb2abf0a163a5d2938b
SHA512

f6b8d0c7f0f70a021f685b20ea52f434b4e0ce28e38d3f6c0b00247bf98fc6de76b4dba6d0ebee280b37ccde60020a0aff208e7214cadf753151d7fc890572af

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1964 3584 WerFault.exe 3fc734a086c8d3aba757aa147a8d46a317e47bb0372f1fb2abf0a163a5d2938b.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
1964	WerFault.exe
1964	WerFault.exe
1964	WerFault.exe
1964	WerFault.exe
1964	WerFault.exe
1964	WerFault.exe
1964	WerFault.exe
1964	WerFault.exe
1964	WerFault.exe
1964	WerFault.exe
1964	WerFault.exe
1964	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1964 WerFault.exe
Token: SeBackupPrivilege 1964 WerFault.exe
Token: SeDebugPrivilege 1964 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\3fc734a086c8d3aba757aa147a8d46a317e47bb0372f1fb2abf0a163a5d2938b.exe
"C:\Users\Admin\AppData\Local\Temp\3fc734a086c8d3aba757aa147a8d46a317e47bb0372f1fb2abf0a163a5d2938b.exe"
1⤵
PID:3584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3584 -s 236
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1964

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...