5c7a21b5ec3fd95c0471037c62ff310690e3030c0c8d3bcdde40c1caca968253 | Triage

Analysis

max time kernel
123s
max time network
125s
platform
windows10_x64
resource
win10
submitted
30-06-2020 13:08

Sharing

Report Analysis Logs

General

Target

Pallex_products list & diagram_488773.PO.doc.exe
Size

414KB
MD5

ac6816608d01a3e087045826434d764c
SHA1

a11cbc77a89ddaf219ae3a26b4fb515233486700
SHA256

5c7a21b5ec3fd95c0471037c62ff310690e3030c0c8d3bcdde40c1caca968253
SHA512

ab77aa55bc52f1bfee716e2535361535d733c85a04c1ea1d842a2142374c108f3a1e32ce075fa0af52041d3b915f4aa5c5b082a1c7137b0f05989494066bae2d

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1432 3888 WerFault.exe Pallex_products list & diagram_488773.PO.doc.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
1432	WerFault.exe
1432	WerFault.exe
1432	WerFault.exe
1432	WerFault.exe
1432	WerFault.exe
1432	WerFault.exe
1432	WerFault.exe
1432	WerFault.exe
1432	WerFault.exe
1432	WerFault.exe
1432	WerFault.exe
1432	WerFault.exe
1432	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1432 WerFault.exe
Token: SeBackupPrivilege 1432 WerFault.exe
Token: SeDebugPrivilege 1432 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Pallex_products list & diagram_488773.PO.doc.exe
"C:\Users\Admin\AppData\Local\Temp\Pallex_products list & diagram_488773.PO.doc.exe"
1⤵
PID:3888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 892
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1432-0-0x00000000045C0000-0x00000000045C1000-memory.dmp

Filesize
4KB

Download
memory/1432-1-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

Filesize
4KB

Download