5daf575c05c6ce4dbd7262850d5031810445a93f11ee3e29357c8eed4c9271e9 | Triage

Analysis

max time kernel
135s
max time network
137s
platform
windows10_x64
resource
win10
submitted
30-06-2020 15:29

Sharing

Report Analysis Logs

General

Target

ORDINE 2848 300620 OP 1 PRENOTAZIONE SCARICO.exe
Size

501KB
MD5

0485f54184da61a8f5dd490c21928b21
SHA1

c860935690c8a9fb08413c36f5f27e06255dd686
SHA256

5daf575c05c6ce4dbd7262850d5031810445a93f11ee3e29357c8eed4c9271e9
SHA512

2112abe8d2a2dd0a747dcb2d957f58f355cabd249ff79ae9ebed6a0ae9d952cbcac4979663703d2d428b76c628fbf01a28f39d9839ac2f034a90b044d256de57

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3940 748 WerFault.exe ORDINE 2848 300620 OP 1 PRENOTAZIONE SCARICO.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3940 WerFault.exe
Token: SeBackupPrivilege 3940 WerFault.exe
Token: SeDebugPrivilege 3940 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ORDINE 2848 300620 OP 1 PRENOTAZIONE SCARICO.exe
"C:\Users\Admin\AppData\Local\Temp\ORDINE 2848 300620 OP 1 PRENOTAZIONE SCARICO.exe"
1⤵
PID:748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 900
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3940-0-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

Filesize
4KB

Download
memory/3940-1-0x0000000005300000-0x0000000005301000-memory.dmp

Filesize
4KB

Download