35b0f0ea8e64564dacb06fb7c9c4816cbe2962e27c72e83b6cca54c92582a620 | Triage

Analysis

max time kernel
134s
max time network
138s
platform
windows10_x64
resource
win10
submitted
30-06-2020 06:04

Sharing

Report Analysis Logs

General

Target

X4EbSoE9zyT73W8.exe
Size

303KB
MD5

36a98997a49aecb3bdb906085560ad8f
SHA1

dfe0df5a15ca5400f2c63e16ede906621778e968
SHA256

35b0f0ea8e64564dacb06fb7c9c4816cbe2962e27c72e83b6cca54c92582a620
SHA512

fb0bb249a7db74c2cc5ded85054ee93fb4dc1402ceac66486a57b35f413b8341cefed6ce396841d2ac5a33e291c9f1a4e3b47e42457b3496b99ea80a6af50dd8

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3872 716 WerFault.exe X4EbSoE9zyT73W8.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3872 WerFault.exe
Token: SeBackupPrivilege 3872 WerFault.exe
Token: SeDebugPrivilege 3872 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\X4EbSoE9zyT73W8.exe
"C:\Users\Admin\AppData\Local\Temp\X4EbSoE9zyT73W8.exe"
1⤵
PID:716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 716 -s 892
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3872-0-0x00000000047A0000-0x00000000047A1000-memory.dmp

Filesize
4KB

Download
memory/3872-2-0x0000000004E60000-0x0000000004E61000-memory.dmp

Filesize
4KB

Download