81017d8c509a860f8c0181a8e7a33c1c6fd27e69d995a734ede171e4b999da81 | Triage

Analysis

max time kernel
75s
max time network
148s
platform
windows10_x64
resource
win10
submitted
30-06-2020 06:26

Sharing

Report Analysis Logs

General

Target

PO#8434223.exe
Size

656KB
MD5

61356bd5db7975da21da4bda24adce56
SHA1

be07eab48cf6fbe157b66b73c4ffabe8a5a20841
SHA256

81017d8c509a860f8c0181a8e7a33c1c6fd27e69d995a734ede171e4b999da81
SHA512

2c929c689e2711370e566aceaa1067f1acbbad1f02a6a5e504d7bcb0872eba0b3855091c2f11164af0ad85338da6c83b81e22c0740252e49546710e52e68072f

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3636 792 WerFault.exe PO#8434223.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe
3636	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3636 WerFault.exe
Token: SeBackupPrivilege 3636 WerFault.exe
Token: SeDebugPrivilege 3636 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\PO#8434223.exe
"C:\Users\Admin\AppData\Local\Temp\PO#8434223.exe"
1⤵
PID:792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 792 -s 1120
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3636-0-0x00000000042E0000-0x00000000042E1000-memory.dmp

Filesize
4KB

Download
memory/3636-1-0x0000000004A10000-0x0000000004A11000-memory.dmp

Filesize
4KB

Download