Analysis
-
max time kernel
112s -
resource
win7v191014 -
submitted
09-01-2020 09:55
Task
task1
Sample
0d19f60423cb2128555e831dc340152f9588c99f3e47d64f0bb4206a6213d579.exe
Resource
win7v191014
0 signatures
Task
task2
Sample
0d19f60423cb2128555e831dc340152f9588c99f3e47d64f0bb4206a6213d579.exe
Resource
win10v191014
0 signatures
General
-
Target
0d19f60423cb2128555e831dc340152f9588c99f3e47d64f0bb4206a6213d579
-
Sample
200109-9cw38n1aex
-
SHA256
0d19f60423cb2128555e831dc340152f9588c99f3e47d64f0bb4206a6213d579
Score
7/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WerFault.exedescription pid process Token: SeDebugPrivilege 1268 WerFault.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
WerFault.exepid process 1268 WerFault.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid process 1268 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d19f60423cb2128555e831dc340152f9588c99f3e47d64f0bb4206a6213d579.exe"C:\Users\Admin\AppData\Local\Temp\0d19f60423cb2128555e831dc340152f9588c99f3e47d64f0bb4206a6213d579.exe"1⤵PID:2036
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 2241⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash
PID:1268