8e46fce2bda79da5d4d8a9b5f3dc6c8295eee0968a9114e0559977f22dd71812 | Triage

Analysis

max time kernel
66s
max time network
110s
platform
windows10_x64
resource
win10
submitted
30-06-2020 12:04

Sharing

Report Analysis Logs

General

Target

K_29062020.exe
Size

239KB
MD5

f4005a8e6c90f6be60b00fd3e9b78d9c
SHA1

db59c3f86aab8054773540434fcef3a18ccda89f
SHA256

8e46fce2bda79da5d4d8a9b5f3dc6c8295eee0968a9114e0559977f22dd71812
SHA512

32189865770a08f7526f6735e14cc185423ac0dd2566368cd1cc7471e4c07762104f399fa3a710df504a2b931b84aa1038e4af06488f8788b515671b940fe000

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3856 2728 WerFault.exe K_29062020.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3856 WerFault.exe
Token: SeBackupPrivilege 3856 WerFault.exe
Token: SeDebugPrivilege 3856 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\K_29062020.exe
"C:\Users\Admin\AppData\Local\Temp\K_29062020.exe"
1⤵
PID:2728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 1168
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3856-0-0x0000000004300000-0x0000000004301000-memory.dmp

Filesize
4KB

Download
memory/3856-1-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

Filesize
4KB

Download