adfd200a16ffe7c04631176e3ad03ded8785c7ecf9581f42915ea199f8c27e9b | Triage

Analysis

max time kernel
135s
max time network
137s
platform
windows10_x64
resource
win10
submitted
30-06-2020 14:25

Sharing

Report Analysis Logs

General

Target

ot1ZIWtPLBLdX65.exe
Size

709KB
MD5

e1523c7b16c25f71620c2f5c9d60503d
SHA1

3566b5b47538584cf7866c3030084eafbf67bbae
SHA256

adfd200a16ffe7c04631176e3ad03ded8785c7ecf9581f42915ea199f8c27e9b
SHA512

b7129191a8a91cce22a9e746b3c23f7de1a0f825f74c5408e5d450d0bdee0439d050c93c1e0d3fc1e3e70572819c0d2cfeed8e331cc9bf5a0dc1fc464ee27c80

Score

3^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3868 WerFault.exe
Token: SeBackupPrivilege 3868 WerFault.exe
Token: SeDebugPrivilege 3868 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3868 8 WerFault.exe ot1ZIWtPLBLdX65.exe

C:\Users\Admin\AppData\Local\Temp\ot1ZIWtPLBLdX65.exe
"C:\Users\Admin\AppData\Local\Temp\ot1ZIWtPLBLdX65.exe"
1⤵
PID:8

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8 -s 1172
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash
PID:3868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3868-0-0x00000000043C0000-0x00000000043C1000-memory.dmp

Filesize
4KB

Download
memory/3868-1-0x0000000004B00000-0x0000000004B01000-memory.dmp

Filesize
4KB

Download