be06b8eb9fc296493c0f6838ad4b55993e2076c53383565cbfa03715af7cc2cd | Triage

Analysis

max time kernel
114s
max time network
137s
platform
windows10_x64
resource
win10v200430
submitted
30-06-2020 05:47

Sharing

Report Analysis Logs

General

Target

PICKING LIST.exe
Size

240KB
MD5

4cf22b7498169674c8702bc82ca2c4fe
SHA1

60203e9be1c7be54a5725f99d16c50d347e1d759
SHA256

be06b8eb9fc296493c0f6838ad4b55993e2076c53383565cbfa03715af7cc2cd
SHA512

36bafc5a38dfb42461d5fb3066551214cd6e58661596565b6656f426a2412346437fb1b56172d06b82fc5ab2e1dae38217341040ef970d20fe9a0b692df200b4

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3640 4012 WerFault.exe PICKING LIST.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3640 WerFault.exe
Token: SeBackupPrivilege 3640 WerFault.exe
Token: SeDebugPrivilege 3640 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3640	WerFault.exe
3640	WerFault.exe
3640	WerFault.exe
3640	WerFault.exe
3640	WerFault.exe
3640	WerFault.exe
3640	WerFault.exe
3640	WerFault.exe
3640	WerFault.exe
3640	WerFault.exe
3640	WerFault.exe
3640	WerFault.exe
3640	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\PICKING LIST.exe
"C:\Users\Admin\AppData\Local\Temp\PICKING LIST.exe"
1⤵
PID:4012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4012 -s 1172
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3640-0-0x0000000004130000-0x0000000004131000-memory.dmp

Filesize
4KB

Download
memory/3640-1-0x0000000004960000-0x0000000004961000-memory.dmp

Filesize
4KB

Download