1ba1a86e6f5e0e1e2f1a596018465345a90822163264c05647e8155edb88ce64 | Triage

Analysis

max time kernel
134s
max time network
91s
platform
windows10_x64
resource
win10v200430
submitted
24-06-2020 15:06

Sharing

Report Analysis Logs

General

Target

1ba1a86e6f5e0e1e2f1a596018465345a90822163264c05647e8155edb88ce64.exe
Size

380KB
MD5

1016a9cc08ad611bccaa936c16d87c32
SHA1

fa149e450522fcbcd7ae0469ded554bd7a58b6d5
SHA256

1ba1a86e6f5e0e1e2f1a596018465345a90822163264c05647e8155edb88ce64
SHA512

4e1d65ae643e56bb16b364f1de519a62a6f8a85c2d0709fa0d2447180ee4f293e1f8d65488d0b717d2de0d8e7b7f69b5fe65a5aa2123acd79ab10c06acac352b

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1476 1516 WerFault.exe 1ba1a86e6f5e0e1e2f1a596018465345a90822163264c05647e8155edb88ce64.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
1476	WerFault.exe
1476	WerFault.exe
1476	WerFault.exe
1476	WerFault.exe
1476	WerFault.exe
1476	WerFault.exe
1476	WerFault.exe
1476	WerFault.exe
1476	WerFault.exe
1476	WerFault.exe
1476	WerFault.exe
1476	WerFault.exe
1476	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1476 WerFault.exe
Token: SeBackupPrivilege 1476 WerFault.exe
Token: SeDebugPrivilege 1476 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1ba1a86e6f5e0e1e2f1a596018465345a90822163264c05647e8155edb88ce64.exe
"C:\Users\Admin\AppData\Local\Temp\1ba1a86e6f5e0e1e2f1a596018465345a90822163264c05647e8155edb88ce64.exe"
1⤵
PID:1516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 1136
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1476

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1476-0-0x0000000004750000-0x0000000004751000-memory.dmp

Filesize
4KB

Download
memory/1476-2-0x00000000050A0000-0x00000000050A1000-memory.dmp

Filesize
4KB

Download
memory/1476-60-0x00000000050A0000-0x00000000050A1000-memory.dmp

Filesize
4KB

Download