dd812ba2bc5f441d8a9594443040f8fea7e3f91bdf1dd1968bbbbc7747e0bc68 | Triage

Analysis

max time kernel
120s
max time network
132s
platform
windows10_x64
resource
win10-en-20211208
submitted
30-01-2022 08:10

Sharing

Report Analysis Logs

General

Target

dd812ba2bc5f441d8a9594443040f8fea7e3f91bdf1dd1968bbbbc7747e0bc68.exe
Size

141KB
MD5

c6f49e8eec2e156e5e36eb7b27ec7929
SHA1

5685728581547dc774396165431a66de3d2526f7
SHA256

dd812ba2bc5f441d8a9594443040f8fea7e3f91bdf1dd1968bbbbc7747e0bc68
SHA512

a01d6f38a485ec890834b164447fd97485adc3883cb9979dbd4cb7e97e213e2a39f82d7e851de4c5bbce42ab09ae161fd2ec2f53ce1ffc14102e33f5744f5bcd

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3584	3600	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3584	WerFault.exe
3584	WerFault.exe
3584	WerFault.exe
3584	WerFault.exe
3584	WerFault.exe
3584	WerFault.exe
3584	WerFault.exe
3584	WerFault.exe
3584	WerFault.exe
3584	WerFault.exe
3584	WerFault.exe
3584	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3584	WerFault.exe
Token: SeBackupPrivilege	3584	WerFault.exe
Token: SeDebugPrivilege	3584	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\dd812ba2bc5f441d8a9594443040f8fea7e3f91bdf1dd1968bbbbc7747e0bc68.exe
"C:\Users\Admin\AppData\Local\Temp\dd812ba2bc5f441d8a9594443040f8fea7e3f91bdf1dd1968bbbbc7747e0bc68.exe"
1⤵
PID:3600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 380
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads