dfa098b2094107457d9bbe4511620001c72842c5c0240a3ab58989d5ebb49c97 | Triage

Analysis

max time kernel
66s
max time network
100s
platform
windows10_x64
resource
win10v200430
submitted
30-06-2020 21:12

Sharing

Report Analysis Logs

General

Target

doc07486620200116112353 pdf..exe
Size

582KB
MD5

3c6eef45d23c93f32edaa81f6b7c8c54
SHA1

fcdfb605f8241f8dd1142f1c197ba56c4489dd38
SHA256

dfa098b2094107457d9bbe4511620001c72842c5c0240a3ab58989d5ebb49c97
SHA512

588c7bb8355963a4979d8ddf2e9aab07bd046e3a8b99db0d60e918e4d6d0d6f66c46a204c770e87e88feb6c420705cc6fdb6fbc6e053c7d68fa8c7b6c589ae32

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2080 3144 WerFault.exe doc07486620200116112353 pdf..exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2080 WerFault.exe
Token: SeBackupPrivilege 2080 WerFault.exe
Token: SeDebugPrivilege 2080 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\doc07486620200116112353 pdf..exe
"C:\Users\Admin\AppData\Local\Temp\doc07486620200116112353 pdf..exe"
1⤵
PID:3144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 900
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2080-0-0x0000000005010000-0x0000000005011000-memory.dmp

Filesize
4KB

Download
memory/2080-1-0x0000000005410000-0x0000000005411000-memory.dmp

Filesize
4KB

Download
memory/2080-2-0x0000000005610000-0x0000000005611000-memory.dmp

Filesize
4KB

Download