dd094a53acb45fb8c7ad5b00763b86703e63a2c1382a0711405a3b8aab68753d | Triage

Analysis

max time kernel
73s
max time network
91s
platform
windows10_x64
resource
win10
submitted
30-06-2020 12:02

Sharing

Report Analysis Logs

General

Target

CI, PL & Draft BL.scr
Size

548KB
MD5

e1b0c67785b827e7d33c6150dbd2f199
SHA1

1d8fdd7eb1c87fb8b04bd1e3384f5d27e46ba307
SHA256

dd094a53acb45fb8c7ad5b00763b86703e63a2c1382a0711405a3b8aab68753d
SHA512

581b94f4c67b9569e449eba88212ab17ff4293f96acf523bbcc50b4fbe3d2b5005276781d493999192a0018c5a449cf2c91fe5e41924a9db89cb6900a5b26428

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3868 3888 WerFault.exe CI, PL & Draft BL.scr

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3868 WerFault.exe
Token: SeBackupPrivilege 3868 WerFault.exe
Token: SeDebugPrivilege 3868 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\CI, PL & Draft BL.scr
"C:\Users\Admin\AppData\Local\Temp\CI, PL & Draft BL.scr" /S
1⤵
PID:3888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 892
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3868-0-0x00000000044A0000-0x00000000044A1000-memory.dmp

Filesize
4KB

Download
memory/3868-1-0x0000000004B50000-0x0000000004B51000-memory.dmp

Filesize
4KB

Download