95202fe13309a9b1651766298c833b21494a92f0b210fc6469d79d3fa444db81 | Triage

Resubmissions

13-02-2022 03:51

220213-eetlyafdbq 10

01-02-2022 14:04

220201-rdsdpsfder 10

30-01-2022 23:37

220130-3l5jsacben 3

Analysis

max time kernel
122s
max time network
147s
platform
windows10_x64
resource
win10-en-20211208
submitted
30-01-2022 23:37

Sharing

Report Analysis Logs

General

Target

95202fe13309a9b1651766298c833b21494a92f0b210fc6469d79d3fa444db81.exe
Size

397KB
MD5

060d27d25844b408e0d5d6d42684b669
SHA1

5105db84660209f5481880e09145536254c6995b
SHA256

95202fe13309a9b1651766298c833b21494a92f0b210fc6469d79d3fa444db81
SHA512

1bbd305e1e003390f9b74b553d30650e8580a5c642b403584b67993d243d6676448ccfb3db31d1c2e62852dd21ceb16e1087bc25d5c19593e03b50281728c5b0

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3364 2496 WerFault.exe 95202fe13309a9b1651766298c833b21494a92f0b210fc6469d79d3fa444db81.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
3364	WerFault.exe
3364	WerFault.exe
3364	WerFault.exe
3364	WerFault.exe
3364	WerFault.exe
3364	WerFault.exe
3364	WerFault.exe
3364	WerFault.exe
3364	WerFault.exe
3364	WerFault.exe
3364	WerFault.exe
3364	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3364 WerFault.exe
Token: SeBackupPrivilege 3364 WerFault.exe
Token: SeDebugPrivilege 3364 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\95202fe13309a9b1651766298c833b21494a92f0b210fc6469d79d3fa444db81.exe
"C:\Users\Admin\AppData\Local\Temp\95202fe13309a9b1651766298c833b21494a92f0b210fc6469d79d3fa444db81.exe"
1⤵
PID:2496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 580
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3364

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2496-118-0x0000000001260000-0x00000000022D4000-memory.dmp

Filesize
16.5MB

Download