ca6d1749f9645475aa7ab0ca268e31ba00817a8c70467c4d6d88bb2ca54d596d | Triage

Analysis

max time kernel
136s
max time network
76s
platform
windows10_x64
resource
win10v200430
submitted
29-06-2020 07:28

Sharing

Report Analysis Logs

General

Target

ca6d1749f9645475aa7ab0ca268e31ba00817a8c70467c4d6d88bb2ca54d596d.exe
Size

335KB
MD5

a6be592fb62d3e95befa3d40fe603f10
SHA1

e2531f4fac0b8fcfdf87ab86b5d73a18229416c2
SHA256

ca6d1749f9645475aa7ab0ca268e31ba00817a8c70467c4d6d88bb2ca54d596d
SHA512

5428156b60a289d7c8009ebeb715d863f9bbd015ae834a4f213570595ca47cb4efb7ca0d16a317e7bb9cfc9123e416970064cf628f31c39ccc714181cb3893b8

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1180 992 WerFault.exe ca6d1749f9645475aa7ab0ca268e31ba00817a8c70467c4d6d88bb2ca54d596d.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1180 WerFault.exe
Token: SeBackupPrivilege 1180 WerFault.exe
Token: SeDebugPrivilege 1180 WerFault.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ca6d1749f9645475aa7ab0ca268e31ba00817a8c70467c4d6d88bb2ca54d596d.exe
"C:\Users\Admin\AppData\Local\Temp\ca6d1749f9645475aa7ab0ca268e31ba00817a8c70467c4d6d88bb2ca54d596d.exe"
1⤵
PID:992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 1108
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1180

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1180-0-0x0000000004350000-0x0000000004351000-memory.dmp

Filesize
4KB

Download
memory/1180-2-0x0000000004B80000-0x0000000004B81000-memory.dmp

Filesize
4KB

Download