ead217093eb194a4c15621c50213435e6e7bb2d955a4cd38a3f20acd099fba7b | Triage

Analysis

max time kernel
62s
max time network
113s
platform
windows10_x64
resource
win10
submitted
07-07-2020 10:01

Sharing

Report Analysis Logs

General

Target

002344772020_PDF.exe
Size

912KB
MD5

69718485be5ae4f3e6a4f6a721a1af44
SHA1

f3b91a1eaa8e6ff6704f0a62e27203abb0ffc0a2
SHA256

ead217093eb194a4c15621c50213435e6e7bb2d955a4cd38a3f20acd099fba7b
SHA512

c4c6cbda68bd1ed6959ed5389703ca9510acf43729f52c4114edef95b3cf29a8d366d07cc9f6fcb16db5515fd294ac72d6c6169bec90df42678440e3f7a30fdb

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3444 3916 WerFault.exe 002344772020_PDF.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3444 WerFault.exe
Token: SeBackupPrivilege 3444 WerFault.exe
Token: SeDebugPrivilege 3444 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3444	WerFault.exe
3444	WerFault.exe
3444	WerFault.exe
3444	WerFault.exe
3444	WerFault.exe
3444	WerFault.exe
3444	WerFault.exe
3444	WerFault.exe
3444	WerFault.exe
3444	WerFault.exe
3444	WerFault.exe
3444	WerFault.exe
3444	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\002344772020_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\002344772020_PDF.exe"
1⤵
PID:3916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 940
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3444

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3444-0-0x0000000004E30000-0x0000000004E31000-memory.dmp

Filesize
4KB

Download
memory/3444-1-0x0000000004E30000-0x0000000004E31000-memory.dmp

Filesize
4KB

Download
memory/3444-3-0x00000000054E0000-0x00000000054E1000-memory.dmp

Filesize
4KB

Download