8f3b0ef6f4cd6df460722293345a683c186c33bca3f41e1239111ec6868efd3d | Triage

Analysis

max time kernel
127s
max time network
131s
platform
windows10_x64
resource
win10
submitted
30-06-2020 06:39

Sharing

Report Analysis Logs

General

Target

document_pdf.exe
Size

639KB
MD5

e7a5ebe1a43c195f43e96feea6da7345
SHA1

d78d7f07cc571946b549bfd1d2dc700c2d1d27b7
SHA256

8f3b0ef6f4cd6df460722293345a683c186c33bca3f41e1239111ec6868efd3d
SHA512

3508daad7dfa04d5cda400370eb72d1fa2022260a47ef33c5dd7e596f99a6e0b8a1f557bc614bba97713550d42271af1b0e49febcd7a2eacf070e52b09d48336

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4060 3588 WerFault.exe document_pdf.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

document_pdf.exeWerFault.exe

pid	process
3588	document_pdf.exe
4060	WerFault.exe
4060	WerFault.exe
4060	WerFault.exe
4060	WerFault.exe
4060	WerFault.exe
4060	WerFault.exe
4060	WerFault.exe
4060	WerFault.exe
4060	WerFault.exe
4060	WerFault.exe
4060	WerFault.exe
4060	WerFault.exe
4060	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

document_pdf.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	3588	document_pdf.exe
Token: SeRestorePrivilege	4060	WerFault.exe
Token: SeBackupPrivilege	4060	WerFault.exe
Token: SeDebugPrivilege	4060	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\document_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\document_pdf.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 928
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4060-0-0x00000000041B0000-0x00000000041B1000-memory.dmp

Filesize
4KB

Download
memory/4060-2-0x0000000004950000-0x0000000004951000-memory.dmp

Filesize
4KB

Download