0437a3b7c497908d0dc489a1b21cf395b76eedae8f1a1b473ecbb5f02e892bf9 | Triage

Analysis

max time kernel
146s
max time network
102s
platform
windows10_x64
resource
win10v200430
submitted
30-06-2020 06:55

Sharing

Report Analysis Logs

General

Target

0437a3b7c497908d0dc489a1b21cf395b76eedae8f1a1b473ecbb5f02e892bf9.exe
Size

1.6MB
MD5

1930ca258642f47145ba36729c6fbc6f
SHA1

c8248b016315f79cac43e5dd17c677f33b0042e1
SHA256

0437a3b7c497908d0dc489a1b21cf395b76eedae8f1a1b473ecbb5f02e892bf9
SHA512

89ca63e4a781a309ceec1ef36deddd5c7fc061f03e10413ba5b5e6618bef94b991c76121b95372db90b433c402472dba1c99d9574b05ea97714b84b61852f89a

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2272 1808 WerFault.exe 0437a3b7c497908d0dc489a1b21cf395b76eedae8f1a1b473ecbb5f02e892bf9.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2272 WerFault.exe
Token: SeBackupPrivilege 2272 WerFault.exe
Token: SeDebugPrivilege 2272 WerFault.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
2272	WerFault.exe
2272	WerFault.exe
2272	WerFault.exe
2272	WerFault.exe
2272	WerFault.exe
2272	WerFault.exe
2272	WerFault.exe
2272	WerFault.exe
2272	WerFault.exe
2272	WerFault.exe
2272	WerFault.exe
2272	WerFault.exe
2272	WerFault.exe
2272	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\0437a3b7c497908d0dc489a1b21cf395b76eedae8f1a1b473ecbb5f02e892bf9.exe
"C:\Users\Admin\AppData\Local\Temp\0437a3b7c497908d0dc489a1b21cf395b76eedae8f1a1b473ecbb5f02e892bf9.exe"
1⤵
PID:1808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 1172
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:2272

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2272-0-0x0000000004FF0000-0x0000000004FF1000-memory.dmp

Filesize
4KB

Download
memory/2272-1-0x0000000004FF0000-0x0000000004FF1000-memory.dmp

Filesize
4KB

Download
memory/2272-3-0x00000000057B0000-0x00000000057B1000-memory.dmp

Filesize
4KB

Download