cb939d718786f89ced507e2578f992dc26698ed13f744b5b7307f374cd24243d | Triage

Analysis

max time kernel
143s
max time network
147s
platform
windows10_x64
resource
win10v200430
submitted
07-07-2020 09:31

Sharing

Report Analysis Logs

General

Target

PO_287109139.exe
Size

870KB
MD5

e21ee77dc84ea28fa08a6e5f83bc25f9
SHA1

0ee070294a938f4b90ab57e8758d94260d9750f0
SHA256

cb939d718786f89ced507e2578f992dc26698ed13f744b5b7307f374cd24243d
SHA512

b18cc222024f34a1361b3bc801637fb8e2fe6dc5ca3bbb28a3f8936acd09882d7955687a9103cc2823fc43787c031691bd99a90db3dcebb5b635558cbe676c24

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2492	2040	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2492	WerFault.exe
2492	WerFault.exe
2492	WerFault.exe
2492	WerFault.exe
2492	WerFault.exe
2492	WerFault.exe
2492	WerFault.exe
2492	WerFault.exe
2492	WerFault.exe
2492	WerFault.exe
2492	WerFault.exe
2492	WerFault.exe
2492	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2492	WerFault.exe
Token: SeBackupPrivilege	2492	WerFault.exe
Token: SeDebugPrivilege	2492	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\PO_287109139.exe
"C:\Users\Admin\AppData\Local\Temp\PO_287109139.exe"
1⤵
PID:2040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 940
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2492-0-0x0000000004DA0000-0x0000000004DA1000-memory.dmp

Filesize
4KB

Download
memory/2492-1-0x00000000051A0000-0x00000000051A1000-memory.dmp

Filesize
4KB

Download
memory/2492-2-0x00000000053A0000-0x00000000053A1000-memory.dmp

Filesize
4KB

Download