bf2f666cc2bf3dff6a34835ddd2b78a8cf6a6cfc2a725e81226996010669ed2b | Triage

Analysis

max time kernel
142s
max time network
102s
platform
windows10_x64
resource
win10v200430
submitted
01-07-2020 01:34

Sharing

Report Analysis Logs

General

Target

signed_19272.exe
Size

443KB
MD5

89f06f681967303341f46437487c93b8
SHA1

80c5161d3cb2daa2a4352c92be70c084a812ec88
SHA256

bf2f666cc2bf3dff6a34835ddd2b78a8cf6a6cfc2a725e81226996010669ed2b
SHA512

24f1832c2f83cb2a024115941a2391e2b82f7f4fabbc65572b7581e5212a94d42d953572eb455cdffe345fc163a784a04496bd7369965167a1af553516453419

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2484 4004 WerFault.exe signed_19272.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
2484	WerFault.exe
2484	WerFault.exe
2484	WerFault.exe
2484	WerFault.exe
2484	WerFault.exe
2484	WerFault.exe
2484	WerFault.exe
2484	WerFault.exe
2484	WerFault.exe
2484	WerFault.exe
2484	WerFault.exe
2484	WerFault.exe
2484	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2484 WerFault.exe
Token: SeBackupPrivilege 2484 WerFault.exe
Token: SeDebugPrivilege 2484 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\signed_19272.exe
"C:\Users\Admin\AppData\Local\Temp\signed_19272.exe"
1⤵
PID:4004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 1176
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2484-0-0x00000000046E0000-0x00000000046E1000-memory.dmp

Filesize
4KB

Download
memory/2484-1-0x0000000004D20000-0x0000000004D21000-memory.dmp

Filesize
4KB

Download