9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74 | Triage

Analysis

max time kernel
118s
max time network
123s
platform
windows10_x64
resource
win10
submitted
29-06-2020 07:35

Sharing

Report Analysis Logs

General

Target

9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe
Size

184KB
MD5

1415244fa17fe0a50a7868e4b3984c39
SHA1

1de0d09d5731ee580de782ab6a090997a5403b46
SHA256

9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74
SHA512

3d14a122164b002b59fcd3722147fbb4b2a1706890056f2e0a28ff20217ad881ed5b2078588250423dba2df4a5f64642940afa8a4b288812662830e93239c6b3

Score

3^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3824 WerFault.exe
Token: SeBackupPrivilege 3824 WerFault.exe
Token: SeDebugPrivilege 3824 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3824	WerFault.exe
3824	WerFault.exe
3824	WerFault.exe
3824	WerFault.exe
3824	WerFault.exe
3824	WerFault.exe
3824	WerFault.exe
3824	WerFault.exe
3824	WerFault.exe
3824	WerFault.exe
3824	WerFault.exe
3824	WerFault.exe
3824	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3824 3024 WerFault.exe 9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe

C:\Users\Admin\AppData\Local\Temp\9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe
"C:\Users\Admin\AppData\Local\Temp\9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74.exe"
1⤵
PID:3024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 1104
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash
PID:3824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3824-0-0x00000000046D0000-0x00000000046D1000-memory.dmp

Filesize
4KB

Download
memory/3824-1-0x00000000046D0000-0x00000000046D1000-memory.dmp

Filesize
4KB

Download
memory/3824-3-0x00000000048C0000-0x00000000048C1000-memory.dmp

Filesize
4KB

Download
memory/3824-4-0x0000000004CC0000-0x0000000004CC1000-memory.dmp

Filesize
4KB

Download