addb2e3a02342b031f2313bfc910927b94904faed320fc4b52e4b8fec77d622b | Triage

Analysis

max time kernel
131s
max time network
99s
platform
windows10_x64
resource
win10v200430
submitted
30-06-2020 13:22

Sharing

Report Analysis Logs

General

Target

AWB DHL 6357297368.exe
Size

401KB
MD5

1221300c3d055641e3067c1699aa20e3
SHA1

736fb0ca19750112c72dfb189b4dc0539303f45e
SHA256

addb2e3a02342b031f2313bfc910927b94904faed320fc4b52e4b8fec77d622b
SHA512

7a4a365cc87d5d8acc68cceced203b48c2c63190e335294601e0c905fffc44ebc214aff2eb77cc352eafbb8c96fd000d9eed684746b7271560cda162ff935903

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3816 1732 WerFault.exe AWB DHL 6357297368.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe
3816	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3816 WerFault.exe
Token: SeBackupPrivilege 3816 WerFault.exe
Token: SeDebugPrivilege 3816 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\AWB DHL 6357297368.exe
"C:\Users\Admin\AppData\Local\Temp\AWB DHL 6357297368.exe"
1⤵
PID:1732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 896
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3816-0-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

Filesize
4KB

Download
memory/3816-1-0x0000000005580000-0x0000000005581000-memory.dmp

Filesize
4KB

Download