dd812ba2bc5f441d8a9594443040f8fea7e3f91bdf1dd1968bbbbc7747e0bc68 | Triage™

Analysis

max time kernel
120s
max time network
132s
platform
windows10_x64
resource
win10-en-20211208
submitted
30/01/2022, 08:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dd812ba2bc5f441d8a9594443040f8fea7e3f91bdf1dd1968bbbbc7747e0bc68.exe
Size 141KB
Sample220130-j2364shbhr
SHA256 dd812ba2bc5f441d8a9594443040f8fea7e3f91bdf1dd1968bbbbc7747e0bc68
MD5 c6f49e8eec2e156e5e36eb7b27ec7929
SHA1 5685728581547dc774396165431a66de3d2526f7
SHA512 a01d6f38a485ec890834b164447fd97485adc3883cb9979dbd4cb7e97e213e2a39f82d7e851de4c5bbce42ab09ae161fd2ec2f53ce1ffc14102e33f5744f5bcd
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3584	3600	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3584	WerFault.exe
3584	WerFault.exe
3584	WerFault.exe
3584	WerFault.exe
3584	WerFault.exe
3584	WerFault.exe
3584	WerFault.exe
3584	WerFault.exe
3584	WerFault.exe
3584	WerFault.exe
3584	WerFault.exe
3584	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3584	WerFault.exe
Token: SeBackupPrivilege	3584	WerFault.exe
Token: SeDebugPrivilege	3584	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\dd812ba2bc5f441d8a9594443040f8fea7e3f91bdf1dd1968bbbbc7747e0bc68.exe
"C:\Users\Admin\AppData\Local\Temp\dd812ba2bc5f441d8a9594443040f8fea7e3f91bdf1dd1968bbbbc7747e0bc68.exe"
1⤵
PID:3600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 380
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads