3588173f7bba171f9583f10d68405f7cb1ee5096bd88dbc4aa14f6cb6a9bdb81 | Triage

Analysis

max time kernel
120s
max time network
169s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-01-2022 02:17

Sharing

Report Analysis Logs

General

Target

3588173f7bba171f9583f10d68405f7cb1ee5096bd88dbc4aa14f6cb6a9bdb81.exe
Size

176KB
MD5

60658a91c768190fe0d2af85e01b65a1
SHA1

c910ac4e5fc7ec19da61b2ca5e2ac9ae245769b0
SHA256

3588173f7bba171f9583f10d68405f7cb1ee5096bd88dbc4aa14f6cb6a9bdb81
SHA512

53582b4a439650b30a264c8a6928b725ad2a91701dd33140f9a88a8e757cfe94830209db55ec8baff6231a28cf778edf8ad51e5617ce0d19b4dcfcdff3257fda

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2836 508 WerFault.exe 3588173f7bba171f9583f10d68405f7cb1ee5096bd88dbc4aa14f6cb6a9bdb81.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
2836	WerFault.exe
2836	WerFault.exe
2836	WerFault.exe
2836	WerFault.exe
2836	WerFault.exe
2836	WerFault.exe
2836	WerFault.exe
2836	WerFault.exe
2836	WerFault.exe
2836	WerFault.exe
2836	WerFault.exe
2836	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2836 WerFault.exe
Token: SeBackupPrivilege 2836 WerFault.exe
Token: SeDebugPrivilege 2836 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\3588173f7bba171f9583f10d68405f7cb1ee5096bd88dbc4aa14f6cb6a9bdb81.exe
"C:\Users\Admin\AppData\Local\Temp\3588173f7bba171f9583f10d68405f7cb1ee5096bd88dbc4aa14f6cb6a9bdb81.exe"
1⤵
PID:508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 244
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...