c35937bc43d98d1e895c694a9ce8c4ca621c972df0ef755174080e8429e315d3 | Triage

Analysis

max time kernel
65s
max time network
117s
platform
windows10_x64
resource
win10
submitted
30-06-2020 13:09

Sharing

Report Analysis Logs

General

Target

2020.06-SOA_SDVN.exe
Size

407KB
MD5

e39e25372dd04cd5d14fbc316ab7f4ed
SHA1

bed35121b0337664f4538e50d5d00d8412c53596
SHA256

c35937bc43d98d1e895c694a9ce8c4ca621c972df0ef755174080e8429e315d3
SHA512

7ee37cb9f7b8d0f231e078f38ea0fff90ac5cb46dd77eabf8fa50269e8792af20e8275671c2767ecd4fefac647be5b763d61d56860d41467f00089e890d4889b

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3544 3920 WerFault.exe 2020.06-SOA_SDVN.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3544	WerFault.exe
3544	WerFault.exe
3544	WerFault.exe
3544	WerFault.exe
3544	WerFault.exe
3544	WerFault.exe
3544	WerFault.exe
3544	WerFault.exe
3544	WerFault.exe
3544	WerFault.exe
3544	WerFault.exe
3544	WerFault.exe
3544	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3544 WerFault.exe
Token: SeBackupPrivilege 3544 WerFault.exe
Token: SeDebugPrivilege 3544 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2020.06-SOA_SDVN.exe
"C:\Users\Admin\AppData\Local\Temp\2020.06-SOA_SDVN.exe"
1⤵
PID:3920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 892
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3544-0-0x0000000004810000-0x0000000004811000-memory.dmp

Filesize
4KB

Download
memory/3544-1-0x0000000004810000-0x0000000004811000-memory.dmp

Filesize
4KB

Download