e26a76def39740596843a57c3edcfe9f5000af5f5b538215a5799db58f41fe33 | Triage

Analysis

max time kernel
120s
max time network
129s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-01-2022 03:04

Sharing

Report Analysis Logs

General

Target

e26a76def39740596843a57c3edcfe9f5000af5f5b538215a5799db58f41fe33.exe
Size

117KB
MD5

d498241afe9a02f7cb91a273e3101cc8
SHA1

17b5fb58b4b8770a79d0fe2f9c8bd07f3f469e63
SHA256

e26a76def39740596843a57c3edcfe9f5000af5f5b538215a5799db58f41fe33
SHA512

e0c42be3a46ef2062bd30e66974bacbad651da7f9cd1423965c01ece66ba9e129e9854b08d6bccdd317bd3319251219adfb5801f01fc9f8812e8d7d4ab410546

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2708 2712 WerFault.exe e26a76def39740596843a57c3edcfe9f5000af5f5b538215a5799db58f41fe33.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
2708	WerFault.exe
2708	WerFault.exe
2708	WerFault.exe
2708	WerFault.exe
2708	WerFault.exe
2708	WerFault.exe
2708	WerFault.exe
2708	WerFault.exe
2708	WerFault.exe
2708	WerFault.exe
2708	WerFault.exe
2708	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2708 WerFault.exe
Token: SeBackupPrivilege 2708 WerFault.exe
Token: SeDebugPrivilege 2708 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\e26a76def39740596843a57c3edcfe9f5000af5f5b538215a5799db58f41fe33.exe
"C:\Users\Admin\AppData\Local\Temp\e26a76def39740596843a57c3edcfe9f5000af5f5b538215a5799db58f41fe33.exe"
1⤵
PID:2712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 376
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads