7201787f662618eb96e10f46c29872dadecf33f6b12920eac8ec9b9dd1724cd6 | Triage

Analysis

max time kernel
145s
max time network
149s
platform
windows10_x64
resource
win10v200430
submitted
07-07-2020 06:00

Sharing

Report Analysis Logs

General

Target

88f10afbe4add77cdc52f99018ea9ba2.exe
Size

657KB
MD5

88f10afbe4add77cdc52f99018ea9ba2
SHA1

e97ad30d3c28b0636e3a30c3ccf9c5d82fe78a52
SHA256

7201787f662618eb96e10f46c29872dadecf33f6b12920eac8ec9b9dd1724cd6
SHA512

ec16f7c01a26adf52711d949881189e0b6c1a3d4d167273194c6c035d4d16376d74c6d227e0ddcfc150b392e72b21d226a99cd239a09bd46348115caf7bd8511

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1568 1624 WerFault.exe 88f10afbe4add77cdc52f99018ea9ba2.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

88f10afbe4add77cdc52f99018ea9ba2.exeWerFault.exe

pid	process
1624	88f10afbe4add77cdc52f99018ea9ba2.exe
1568	WerFault.exe
1568	WerFault.exe
1568	WerFault.exe
1568	WerFault.exe
1568	WerFault.exe
1568	WerFault.exe
1568	WerFault.exe
1568	WerFault.exe
1568	WerFault.exe
1568	WerFault.exe
1568	WerFault.exe
1568	WerFault.exe
1568	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

88f10afbe4add77cdc52f99018ea9ba2.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	1624	88f10afbe4add77cdc52f99018ea9ba2.exe
Token: SeRestorePrivilege	1568	WerFault.exe
Token: SeBackupPrivilege	1568	WerFault.exe
Token: SeDebugPrivilege	1568	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\88f10afbe4add77cdc52f99018ea9ba2.exe
"C:\Users\Admin\AppData\Local\Temp\88f10afbe4add77cdc52f99018ea9ba2.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 948
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1568-0-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

Filesize
4KB

Download
memory/1568-1-0x0000000005610000-0x0000000005611000-memory.dmp

Filesize
4KB

Download