2c8ff4d56b32520a12186a59b34aff782617ed6f523f0524ac4b2cc38ec73044 | Triage

Analysis

max time kernel
119s
max time network
126s
platform
windows10_x64
resource
win10-en-20211208
submitted
30-01-2022 07:54

Sharing

Report Analysis Logs

General

Target

2c8ff4d56b32520a12186a59b34aff782617ed6f523f0524ac4b2cc38ec73044.exe
Size

381KB
MD5

86f436d4fd15f9ff2cd1ae317799d596
SHA1

23e01fdd3ea53f08e9d3c493afd6b4da669c6bac
SHA256

2c8ff4d56b32520a12186a59b34aff782617ed6f523f0524ac4b2cc38ec73044
SHA512

a1f959a95c426b2949af582e6d296eda7cbb6ee790ac2f7de09f8fc843077d08adc5a2fa2d7279e206e2cc9643e93ec7d32ea80dc1628f02586d5ddae31c2d21

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3012 2140 WerFault.exe 2c8ff4d56b32520a12186a59b34aff782617ed6f523f0524ac4b2cc38ec73044.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
3012	WerFault.exe
3012	WerFault.exe
3012	WerFault.exe
3012	WerFault.exe
3012	WerFault.exe
3012	WerFault.exe
3012	WerFault.exe
3012	WerFault.exe
3012	WerFault.exe
3012	WerFault.exe
3012	WerFault.exe
3012	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3012 WerFault.exe
Token: SeBackupPrivilege 3012 WerFault.exe
Token: SeDebugPrivilege 3012 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2c8ff4d56b32520a12186a59b34aff782617ed6f523f0524ac4b2cc38ec73044.exe
"C:\Users\Admin\AppData\Local\Temp\2c8ff4d56b32520a12186a59b34aff782617ed6f523f0524ac4b2cc38ec73044.exe"
1⤵
PID:2140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 232
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3012

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...