Analysis
-
max time kernel
68s -
max time network
96s -
platform
windows10_x64 -
resource
win10 -
submitted
07-07-2020 09:00
Static task
static1
Behavioral task
behavioral1
Sample
Company Info.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Company Info.exe
Resource
win10
0 signatures
0 seconds
General
-
Target
Company Info.exe
-
Size
1.0MB
-
MD5
49c568fb7de5bb77140ab3b40e54fdff
-
SHA1
6d74dbf23a857e11d9a30a28e2ebe7dc3b74735a
-
SHA256
77f7dd01dbc1cfa243fc8301937058094b3c02ffb3f18e8dd7b3221723705049
-
SHA512
de918d8654df77256b5a7036c8c5e969605c2744e160b58cb5bd86e0abcf691c9f55bff43299b3149152ce5c02191c9b8e56b4254dad7e9dea2c7dc7b41489de
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1840 3068 WerFault.exe Company Info.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 1840 WerFault.exe Token: SeBackupPrivilege 1840 WerFault.exe Token: SeDebugPrivilege 1840 WerFault.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
WerFault.exepid process 1840 WerFault.exe 1840 WerFault.exe 1840 WerFault.exe 1840 WerFault.exe 1840 WerFault.exe 1840 WerFault.exe 1840 WerFault.exe 1840 WerFault.exe 1840 WerFault.exe 1840 WerFault.exe 1840 WerFault.exe 1840 WerFault.exe 1840 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Company Info.exe"C:\Users\Admin\AppData\Local\Temp\Company Info.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 9362⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses