7fcec6cab5ea7b810a492aca80f8286eaf595d7826dad8e642347353c8ef982f | Triage

Analysis

max time kernel
135s
max time network
137s
platform
windows10_x64
resource
win10
submitted
02-07-2020 17:42

Sharing

Report Analysis Logs

General

Target

e2e89b28656886ead31cceb62f78b80b.exe
Size

210KB
MD5

e2e89b28656886ead31cceb62f78b80b
SHA1

14f78bf703b0a20409f4f20d0241ff1d287963d9
SHA256

7fcec6cab5ea7b810a492aca80f8286eaf595d7826dad8e642347353c8ef982f
SHA512

054e52875c5974da2321438208aeec1854b52e386f13138792d4f0b102d58cd0a829020c3d17b68309a93a00a308b70b55598a5fa8273e9fe39f9cf6f1a68b84

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3788 3544 WerFault.exe e2e89b28656886ead31cceb62f78b80b.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3788	WerFault.exe
3788	WerFault.exe
3788	WerFault.exe
3788	WerFault.exe
3788	WerFault.exe
3788	WerFault.exe
3788	WerFault.exe
3788	WerFault.exe
3788	WerFault.exe
3788	WerFault.exe
3788	WerFault.exe
3788	WerFault.exe
3788	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3788 WerFault.exe
Token: SeBackupPrivilege 3788 WerFault.exe
Token: SeDebugPrivilege 3788 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\e2e89b28656886ead31cceb62f78b80b.exe
"C:\Users\Admin\AppData\Local\Temp\e2e89b28656886ead31cceb62f78b80b.exe"
1⤵
PID:3544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 1152
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3788-0-0x0000000004B90000-0x0000000004B91000-memory.dmp

Filesize
4KB

Download
memory/3788-1-0x0000000004F90000-0x0000000004F91000-memory.dmp

Filesize
4KB

Download
memory/3788-2-0x0000000005390000-0x0000000005391000-memory.dmp

Filesize
4KB

Download