95202fe13309a9b1651766298c833b21494a92f0b210fc6469d79d3fa444db81 | Triage

Resubmissions

13-02-2022 03:51

220213-eetlyafdbq 10

01-02-2022 14:04

220201-rdsdpsfder 10

30-01-2022 23:37

220130-3l5jsacben 3

Analysis

max time kernel
122s
max time network
147s
platform
windows10_x64
resource
win10-en-20211208
submitted
30-01-2022 23:37

Sharing

Report Analysis Logs

General

Target

95202fe13309a9b1651766298c833b21494a92f0b210fc6469d79d3fa444db81.exe
Size

397KB
MD5

060d27d25844b408e0d5d6d42684b669
SHA1

5105db84660209f5481880e09145536254c6995b
SHA256

95202fe13309a9b1651766298c833b21494a92f0b210fc6469d79d3fa444db81
SHA512

1bbd305e1e003390f9b74b553d30650e8580a5c642b403584b67993d243d6676448ccfb3db31d1c2e62852dd21ceb16e1087bc25d5c19593e03b50281728c5b0

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3364	2496	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3364	WerFault.exe
3364	WerFault.exe
3364	WerFault.exe
3364	WerFault.exe
3364	WerFault.exe
3364	WerFault.exe
3364	WerFault.exe
3364	WerFault.exe
3364	WerFault.exe
3364	WerFault.exe
3364	WerFault.exe
3364	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3364	WerFault.exe
Token: SeBackupPrivilege	3364	WerFault.exe
Token: SeDebugPrivilege	3364	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\95202fe13309a9b1651766298c833b21494a92f0b210fc6469d79d3fa444db81.exe
"C:\Users\Admin\AppData\Local\Temp\95202fe13309a9b1651766298c833b21494a92f0b210fc6469d79d3fa444db81.exe"
1⤵
PID:2496
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 580
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2496-118-0x0000000001260000-0x00000000022D4000-memory.dmp

Filesize
16.5MB

Download