ff86462f1b1ab86a5283785ac242e2bcf6fcf46a39e7d2a712eceba8c0c47627 | Triage

Analysis

max time kernel
135s
max time network
136s
platform
windows10_x64
resource
win10
submitted
01-07-2020 17:26

Sharing

Report Analysis Logs

General

Target

0f9edaa5134778747af05306ca0620cc.exe
Size

213KB
MD5

0f9edaa5134778747af05306ca0620cc
SHA1

32872c1265e8b5e2fd1062bc33ab715decf1bafb
SHA256

ff86462f1b1ab86a5283785ac242e2bcf6fcf46a39e7d2a712eceba8c0c47627
SHA512

9e8a5d5aca21fa30b0d8982a16adfb9ecaa7d8f39ea6f3fa1a80271fa9344e1ee956bc9547c1feb8d0e5772f5225054c7f21fbdb48756ba33d0958d96ea0f6f4

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3856 3676 WerFault.exe 0f9edaa5134778747af05306ca0620cc.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3856 WerFault.exe
Token: SeBackupPrivilege 3856 WerFault.exe
Token: SeDebugPrivilege 3856 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\0f9edaa5134778747af05306ca0620cc.exe
"C:\Users\Admin\AppData\Local\Temp\0f9edaa5134778747af05306ca0620cc.exe"
1⤵
PID:3676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 1152
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3856-0-0x00000000045B0000-0x00000000045B1000-memory.dmp

Filesize
4KB

Download
memory/3856-1-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

Filesize
4KB

Download