2bf305e40252953154a29d0887a6703973a4523a77ed89de6b8803f5dd360f57 | Triage

Analysis

max time kernel
122s
max time network
136s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-01-2022 02:21

Sharing

Report Analysis Logs

General

Target

2bf305e40252953154a29d0887a6703973a4523a77ed89de6b8803f5dd360f57.exe
Size

176KB
MD5

d97e7941669a5f68f78603d8b3854762
SHA1

265e7a75838acdf2aeb236aedbd07db2d939bcd6
SHA256

2bf305e40252953154a29d0887a6703973a4523a77ed89de6b8803f5dd360f57
SHA512

687e7a3cfacda0367e25de4e9b437a71a9c21be79df1b90ecf4aa826ffa1d2339672ddda916826201127efe817e7b0ebefc98c001504c744d3df8c7e8a6fa96c

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4084 3388 WerFault.exe 2bf305e40252953154a29d0887a6703973a4523a77ed89de6b8803f5dd360f57.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
4084	WerFault.exe
4084	WerFault.exe
4084	WerFault.exe
4084	WerFault.exe
4084	WerFault.exe
4084	WerFault.exe
4084	WerFault.exe
4084	WerFault.exe
4084	WerFault.exe
4084	WerFault.exe
4084	WerFault.exe
4084	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 4084 WerFault.exe
Token: SeBackupPrivilege 4084 WerFault.exe
Token: SeDebugPrivilege 4084 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2bf305e40252953154a29d0887a6703973a4523a77ed89de6b8803f5dd360f57.exe
"C:\Users\Admin\AppData\Local\Temp\2bf305e40252953154a29d0887a6703973a4523a77ed89de6b8803f5dd360f57.exe"
1⤵
PID:3388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3388 -s 232
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...