c95ca2828f96e70328cd9ac4dfddad25fb0dcddc2e265200401ce10eecf3c2a4 | Triage™

Analysis

max time kernel
131s
max time network
69s
platform
windows10_x64
resource
win10v200430
submitted
28/06/2020, 23:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Doc_43795379326436.exe
Size 327KB
Sample200628-bdmmd47qsx
SHA256 c95ca2828f96e70328cd9ac4dfddad25fb0dcddc2e265200401ce10eecf3c2a4
MD5 24e5934191f08a725c5005adaf753d11
SHA1 21bb5c17690bb277422d855619f0ca7f20182019
SHA512 b8592b9d07d10081f77acfb767d3f7c183a9ab7409d7b9266999e149ad41b83035e76240dcf6de1ab28df7418a57816e05f50614f27ac27238666b56c303278c
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1564	4072	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4072	Doc_43795379326436.exe
1564	WerFault.exe
1564	WerFault.exe
1564	WerFault.exe
1564	WerFault.exe
1564	WerFault.exe
1564	WerFault.exe
1564	WerFault.exe
1564	WerFault.exe
1564	WerFault.exe
1564	WerFault.exe
1564	WerFault.exe
1564	WerFault.exe
1564	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4072	Doc_43795379326436.exe
Token: SeRestorePrivilege	1564	WerFault.exe
Token: SeBackupPrivilege	1564	WerFault.exe
Token: SeDebugPrivilege	1564	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Doc_43795379326436.exe
"C:\Users\Admin\AppData\Local\Temp\Doc_43795379326436.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4072
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 960
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1564-2-0x00000000042D0000-0x00000000042D1000-memory.dmp

Download

memory/1564-3-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

Download