77f7dd01dbc1cfa243fc8301937058094b3c02ffb3f18e8dd7b3221723705049 | Triage

Analysis

max time kernel
68s
max time network
96s
platform
windows10_x64
resource
win10
submitted
07-07-2020 09:00

Sharing

Report Analysis Logs

General

Target

Company Info.exe
Size

1.0MB
MD5

49c568fb7de5bb77140ab3b40e54fdff
SHA1

6d74dbf23a857e11d9a30a28e2ebe7dc3b74735a
SHA256

77f7dd01dbc1cfa243fc8301937058094b3c02ffb3f18e8dd7b3221723705049
SHA512

de918d8654df77256b5a7036c8c5e969605c2744e160b58cb5bd86e0abcf691c9f55bff43299b3149152ce5c02191c9b8e56b4254dad7e9dea2c7dc7b41489de

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1840 3068 WerFault.exe Company Info.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1840 WerFault.exe
Token: SeBackupPrivilege 1840 WerFault.exe
Token: SeDebugPrivilege 1840 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe
1840	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Company Info.exe
"C:\Users\Admin\AppData\Local\Temp\Company Info.exe"
1⤵
PID:3068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 936
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1840-0-0x0000000004310000-0x0000000004311000-memory.dmp

Filesize
4KB

Download
memory/1840-1-0x0000000004310000-0x0000000004311000-memory.dmp

Filesize
4KB

Download
memory/1840-4-0x00000000049C0000-0x00000000049C1000-memory.dmp

Filesize
4KB

Download