d9a4f02d908fbb6ed781ca3193fee8cedc3ae4a800c0acd92134f352436ed4c6 | Triage

Analysis

max time kernel
134s
max time network
83s
platform
windows10_x64
resource
win10v200430
submitted
20-05-2020 00:23

Sharing

Report Analysis Logs

General

Target

d9a4f02d908fbb6ed781ca3193fee8cedc3ae4a800c0acd92134f352436ed4c6.exe
Size

253KB
MD5

489a833e8b95b22d0e0fe116f9f415f3
SHA1

ef6de7f3433f62378497df12f47fc3b718751f13
SHA256

d9a4f02d908fbb6ed781ca3193fee8cedc3ae4a800c0acd92134f352436ed4c6
SHA512

7c0f54cff7cda0b74e2e5d542fcc82ac821c56f723ecbc7a3870802dceb471163bb3a90f3f5d92e7f9c7c77af0dd1aeea6db159a3112f6e3f3d5c837a3c1b551

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1808 3568 WerFault.exe d9a4f02d908fbb6ed781ca3193fee8cedc3ae4a800c0acd92134f352436ed4c6.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1808 WerFault.exe
Token: SeBackupPrivilege 1808 WerFault.exe
Token: SeDebugPrivilege 1808 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
1808	WerFault.exe
1808	WerFault.exe
1808	WerFault.exe
1808	WerFault.exe
1808	WerFault.exe
1808	WerFault.exe
1808	WerFault.exe
1808	WerFault.exe
1808	WerFault.exe
1808	WerFault.exe
1808	WerFault.exe
1808	WerFault.exe
1808	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\d9a4f02d908fbb6ed781ca3193fee8cedc3ae4a800c0acd92134f352436ed4c6.exe
"C:\Users\Admin\AppData\Local\Temp\d9a4f02d908fbb6ed781ca3193fee8cedc3ae4a800c0acd92134f352436ed4c6.exe"
1⤵
PID:3568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3568 -s 1172
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1808-1-0x0000000004410000-0x0000000004411000-memory.dmp

Filesize
4KB

Download
memory/1808-2-0x0000000004B50000-0x0000000004B51000-memory.dmp

Filesize
4KB

Download