dd812ba2bc5f441d8a9594443040f8fea7e3f91bdf1dd1968bbbbc7747e0bc68 | Triage

Analysis

max time kernel
120s
max time network
132s
platform
windows10_x64
resource
win10-en-20211208
submitted
30-01-2022 08:10

Sharing

Report Analysis Logs

General

Target

dd812ba2bc5f441d8a9594443040f8fea7e3f91bdf1dd1968bbbbc7747e0bc68.exe
Size

141KB
MD5

c6f49e8eec2e156e5e36eb7b27ec7929
SHA1

5685728581547dc774396165431a66de3d2526f7
SHA256

dd812ba2bc5f441d8a9594443040f8fea7e3f91bdf1dd1968bbbbc7747e0bc68
SHA512

a01d6f38a485ec890834b164447fd97485adc3883cb9979dbd4cb7e97e213e2a39f82d7e851de4c5bbce42ab09ae161fd2ec2f53ce1ffc14102e33f5744f5bcd

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3584 3600 WerFault.exe dd812ba2bc5f441d8a9594443040f8fea7e3f91bdf1dd1968bbbbc7747e0bc68.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
3584	WerFault.exe
3584	WerFault.exe
3584	WerFault.exe
3584	WerFault.exe
3584	WerFault.exe
3584	WerFault.exe
3584	WerFault.exe
3584	WerFault.exe
3584	WerFault.exe
3584	WerFault.exe
3584	WerFault.exe
3584	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3584 WerFault.exe
Token: SeBackupPrivilege 3584 WerFault.exe
Token: SeDebugPrivilege 3584 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\dd812ba2bc5f441d8a9594443040f8fea7e3f91bdf1dd1968bbbbc7747e0bc68.exe
"C:\Users\Admin\AppData\Local\Temp\dd812ba2bc5f441d8a9594443040f8fea7e3f91bdf1dd1968bbbbc7747e0bc68.exe"
1⤵
PID:3600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 380
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...