fbd01daf6f9541d648c04572779da9203855c18fe20fb333f7b5ed18206abc22 | Triage

Analysis

max time kernel
75s
max time network
148s
platform
windows10_x64
resource
win10
submitted
30-06-2020 19:26

Sharing

Report Analysis Logs

General

Target

ca9b1397310d3cbe5af8773585cbfd29.exe
Size

215KB
MD5

ca9b1397310d3cbe5af8773585cbfd29
SHA1

e4c75367993918616d558dcf5ddab4f544dd49c9
SHA256

fbd01daf6f9541d648c04572779da9203855c18fe20fb333f7b5ed18206abc22
SHA512

d5181670089668e8b03d7eda6aa2e5d38e19b7150eb41b441153f22e4d5718795a781f7fcb2ece9bfefa32eaff43f1b478c792acd87bd461506b7353b61e4c8a

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3556 3404 WerFault.exe ca9b1397310d3cbe5af8773585cbfd29.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3556 WerFault.exe
Token: SeBackupPrivilege 3556 WerFault.exe
Token: SeDebugPrivilege 3556 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3556	WerFault.exe
3556	WerFault.exe
3556	WerFault.exe
3556	WerFault.exe
3556	WerFault.exe
3556	WerFault.exe
3556	WerFault.exe
3556	WerFault.exe
3556	WerFault.exe
3556	WerFault.exe
3556	WerFault.exe
3556	WerFault.exe
3556	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ca9b1397310d3cbe5af8773585cbfd29.exe
"C:\Users\Admin\AppData\Local\Temp\ca9b1397310d3cbe5af8773585cbfd29.exe"
1⤵
PID:3404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 1152
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3556-0-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

Filesize
4KB

Download
memory/3556-1-0x0000000005700000-0x0000000005701000-memory.dmp

Filesize
4KB

Download
memory/3556-2-0x0000000005B00000-0x0000000005B01000-memory.dmp

Filesize
4KB

Download