fb72ce99cc2d45f842ac5cd6e4e3aeb1b9e66e4fea75b4edfd57ce9a8d3223ca | Triage

Analysis

max time kernel
62s
max time network
92s
platform
windows10_x64
resource
win10v200430
submitted
24-06-2020 13:33

Sharing

Report Analysis Logs

General

Target

Factura pendiente.exe
Size

512KB
MD5

85a206115a80d17c60affe071a0358a3
SHA1

8bf88e4e27ed28b6ea14066ec9b53582ee29476a
SHA256

fb72ce99cc2d45f842ac5cd6e4e3aeb1b9e66e4fea75b4edfd57ce9a8d3223ca
SHA512

62ba4aca9df5000f4f55cfacb2f1becbb2277491d45958044836d2f7cf35fcc33dffe149e6d1a8f18154fd4d67425ffff657e689fcbac04acdccb3bd46e47f46

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

372 2564 WerFault.exe Factura pendiente.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
372	WerFault.exe
372	WerFault.exe
372	WerFault.exe
372	WerFault.exe
372	WerFault.exe
372	WerFault.exe
372	WerFault.exe
372	WerFault.exe
372	WerFault.exe
372	WerFault.exe
372	WerFault.exe
372	WerFault.exe
372	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 372 WerFault.exe
Token: SeBackupPrivilege 372 WerFault.exe
Token: SeDebugPrivilege 372 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Factura pendiente.exe
"C:\Users\Admin\AppData\Local\Temp\Factura pendiente.exe"
1⤵
PID:2564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 1112
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/372-0-0x0000000004AD0000-0x0000000004AD1000-memory.dmp

Filesize
4KB

Download
memory/372-1-0x0000000005200000-0x0000000005201000-memory.dmp

Filesize
4KB

Download