c95ca2828f96e70328cd9ac4dfddad25fb0dcddc2e265200401ce10eecf3c2a4 | Triage

Analysis

max time kernel
131s
max time network
69s
platform
windows10_x64
resource
win10v200430
submitted
28-06-2020 23:58

Sharing

Report Analysis Logs

General

Target

Doc_43795379326436.exe
Size

327KB
MD5

24e5934191f08a725c5005adaf753d11
SHA1

21bb5c17690bb277422d855619f0ca7f20182019
SHA256

c95ca2828f96e70328cd9ac4dfddad25fb0dcddc2e265200401ce10eecf3c2a4
SHA512

b8592b9d07d10081f77acfb767d3f7c183a9ab7409d7b9266999e149ad41b83035e76240dcf6de1ab28df7418a57816e05f50614f27ac27238666b56c303278c

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1564	4072	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4072	Doc_43795379326436.exe
1564	WerFault.exe
1564	WerFault.exe
1564	WerFault.exe
1564	WerFault.exe
1564	WerFault.exe
1564	WerFault.exe
1564	WerFault.exe
1564	WerFault.exe
1564	WerFault.exe
1564	WerFault.exe
1564	WerFault.exe
1564	WerFault.exe
1564	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4072	Doc_43795379326436.exe
Token: SeRestorePrivilege	1564	WerFault.exe
Token: SeBackupPrivilege	1564	WerFault.exe
Token: SeDebugPrivilege	1564	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Doc_43795379326436.exe
"C:\Users\Admin\AppData\Local\Temp\Doc_43795379326436.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4072
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 960
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1564-2-0x00000000042D0000-0x00000000042D1000-memory.dmp

Filesize
4KB

Download
memory/1564-3-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

Filesize
4KB

Download