c8c3bc6c01dee147be04e3fbaeb5ff72fbee21e676ba04b7326738e692cec9d0 | Triage

Analysis

max time kernel
131s
max time network
101s
platform
windows10_x64
resource
win10v200430
submitted
30-06-2020 06:56

Sharing

Report Analysis Logs

General

Target

c8c3bc6c01dee147be04e3fbaeb5ff72fbee21e676ba04b7326738e692cec9d0.exe
Size

1.6MB
MD5

372e453ee2f834493417fe5aea1ba23e
SHA1

a7597474eeb9506030d36dbd7fc8d015a50cac8b
SHA256

c8c3bc6c01dee147be04e3fbaeb5ff72fbee21e676ba04b7326738e692cec9d0
SHA512

1f6bd250f321555495289d147a23a9d39eff2c3695ffe575211ca849e4fb128838112cbf5076e37155dc1a4cab596b4290e3570b63ec81dd522fa7b914f9fd31

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2560 1160 WerFault.exe c8c3bc6c01dee147be04e3fbaeb5ff72fbee21e676ba04b7326738e692cec9d0.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2560 WerFault.exe
Token: SeBackupPrivilege 2560 WerFault.exe
Token: SeDebugPrivilege 2560 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
2560	WerFault.exe
2560	WerFault.exe
2560	WerFault.exe
2560	WerFault.exe
2560	WerFault.exe
2560	WerFault.exe
2560	WerFault.exe
2560	WerFault.exe
2560	WerFault.exe
2560	WerFault.exe
2560	WerFault.exe
2560	WerFault.exe
2560	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\c8c3bc6c01dee147be04e3fbaeb5ff72fbee21e676ba04b7326738e692cec9d0.exe
"C:\Users\Admin\AppData\Local\Temp\c8c3bc6c01dee147be04e3fbaeb5ff72fbee21e676ba04b7326738e692cec9d0.exe"
1⤵
PID:1160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 1176
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:2560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2560-0-0x0000000004700000-0x0000000004701000-memory.dmp

Filesize
4KB

Download
memory/2560-1-0x0000000004700000-0x0000000004701000-memory.dmp

Filesize
4KB

Download
memory/2560-3-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

Filesize
4KB

Download