9c7b335e031c3c2fde1e7d75cbe08bd0951b0cb8a327fa4bd3e54c4c59d32936 | Triage

Analysis

max time kernel
131s
max time network
141s
platform
windows10_x64
resource
win10
submitted
07/07/2020, 09:07

Sharing

Report Analysis Logs

General

Target

documents.exe
Size

443KB
MD5

ad79a994c52c067e68f068c32b333d19
SHA1

34f2639723d38c9511beabe5d8ef81a6ff85a460
SHA256

9c7b335e031c3c2fde1e7d75cbe08bd0951b0cb8a327fa4bd3e54c4c59d32936
SHA512

a92bced3534d8e86f65fd2d18ee074d763e0ef9be0be6a9790222e932635545cd5951966f64f5189bbc6fb7d2064526b3f3d9cd526910502adb58408305e603d

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3864	2460	WerFault.exe	66

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3864	WerFault.exe
Token: SeBackupPrivilege	3864	WerFault.exe
Token: SeDebugPrivilege	3864	WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\documents.exe
"C:\Users\Admin\AppData\Local\Temp\documents.exe"
1⤵
PID:2460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 936
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:3864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3864-0-0x0000000004C10000-0x0000000004C11000-memory.dmp

Filesize
4KB

Download
memory/3864-1-0x0000000005350000-0x0000000005351000-memory.dmp

Filesize
4KB

Download