458d776a78396a0b2a3a7f2a66304e5ceb05038b50ad936cecaeba7c584807db | Triage

Analysis

max time kernel
122s
max time network
118s
platform
windows10_x64
resource
win10
submitted
30-06-2020 13:51

Sharing

Report Analysis Logs

General

Target

0e466b730016adff5bcf8b6abfdb5dc8.exe
Size

965KB
MD5

0e466b730016adff5bcf8b6abfdb5dc8
SHA1

86b2e10d572be2c3d05a4b0fc3a2f441fd30d38b
SHA256

458d776a78396a0b2a3a7f2a66304e5ceb05038b50ad936cecaeba7c584807db
SHA512

fcac2b1c9028a093c522140312ada0d2f897e05c41a88d8c5e88eff9c732de2811ffbe4effd65cfedb5822e203149836fcf9299bece2edeafa3db799892cb01e

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 3900 created 976 3900 WerFault.exe 0e466b730016adff5bcf8b6abfdb5dc8.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3900 WerFault.exe
Token: SeBackupPrivilege 3900 WerFault.exe
Token: SeDebugPrivilege 3900 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3900	WerFault.exe
3900	WerFault.exe
3900	WerFault.exe
3900	WerFault.exe
3900	WerFault.exe
3900	WerFault.exe
3900	WerFault.exe
3900	WerFault.exe
3900	WerFault.exe
3900	WerFault.exe
3900	WerFault.exe
3900	WerFault.exe
3900	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3900 976 WerFault.exe 0e466b730016adff5bcf8b6abfdb5dc8.exe

C:\Users\Admin\AppData\Local\Temp\0e466b730016adff5bcf8b6abfdb5dc8.exe
"C:\Users\Admin\AppData\Local\Temp\0e466b730016adff5bcf8b6abfdb5dc8.exe"
1⤵
PID:976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 692
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash
PID:3900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/976-1-0x0000000004560000-0x0000000004561000-memory.dmp

Filesize
4KB

Download
memory/976-2-0x0000000006380000-0x0000000006381000-memory.dmp

Filesize
4KB

Download
memory/3900-3-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

Filesize
4KB

Download
memory/3900-4-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

Filesize
4KB

Download
memory/3900-6-0x00000000051F0000-0x00000000051F1000-memory.dmp

Filesize
4KB

Download