e26a76def39740596843a57c3edcfe9f5000af5f5b538215a5799db58f41fe33 | Triage™

Analysis

max time kernel
120s
max time network
129s
platform
windows10_x64
resource
win10-en-20211208
submitted
24/01/2022, 03:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e26a76def39740596843a57c3edcfe9f5000af5f5b538215a5799db58f41fe33.exe
Size 117KB
Sample220124-dkzvgaagh2
SHA256 e26a76def39740596843a57c3edcfe9f5000af5f5b538215a5799db58f41fe33
MD5 d498241afe9a02f7cb91a273e3101cc8
SHA1 17b5fb58b4b8770a79d0fe2f9c8bd07f3f469e63
SHA512 e0c42be3a46ef2062bd30e66974bacbad651da7f9cd1423965c01ece66ba9e129e9854b08d6bccdd317bd3319251219adfb5801f01fc9f8812e8d7d4ab410546
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2708	2712	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2708	WerFault.exe
2708	WerFault.exe
2708	WerFault.exe
2708	WerFault.exe
2708	WerFault.exe
2708	WerFault.exe
2708	WerFault.exe
2708	WerFault.exe
2708	WerFault.exe
2708	WerFault.exe
2708	WerFault.exe
2708	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2708	WerFault.exe
Token: SeBackupPrivilege	2708	WerFault.exe
Token: SeDebugPrivilege	2708	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\e26a76def39740596843a57c3edcfe9f5000af5f5b538215a5799db58f41fe33.exe
"C:\Users\Admin\AppData\Local\Temp\e26a76def39740596843a57c3edcfe9f5000af5f5b538215a5799db58f41fe33.exe"
1⤵
PID:2712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 376
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads