bd8702a0da9bfee55b775c1762d7ea6dbda8ad845abc4bc278fcb49ab6f2658f | Triage

Analysis

max time kernel
118s
max time network
120s
platform
windows10_x64
resource
win10
submitted
07/07/2020, 17:21

Sharing

Report Analysis Logs

General

Target

Specification and requirements.exe
Size

536KB
MD5

f162d934161f18deefb2be5f84de2788
SHA1

c9f3f7d7d0b392009417383ac995533cc764a9f3
SHA256

bd8702a0da9bfee55b775c1762d7ea6dbda8ad845abc4bc278fcb49ab6f2658f
SHA512

f3dc245b00b318b84d3729e3279dae7322eb5553bf7d3223a7aa7202ffbd1983063b9bf0691f9d9e3a81d134f3993589c13de60f00baa0a141aeb5a60827a447

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3036	3068	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3036	WerFault.exe
3036	WerFault.exe
3036	WerFault.exe
3036	WerFault.exe
3036	WerFault.exe
3036	WerFault.exe
3036	WerFault.exe
3036	WerFault.exe
3036	WerFault.exe
3036	WerFault.exe
3036	WerFault.exe
3036	WerFault.exe
3036	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3036	WerFault.exe
Token: SeBackupPrivilege	3036	WerFault.exe
Token: SeDebugPrivilege	3036	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Specification and requirements.exe
"C:\Users\Admin\AppData\Local\Temp\Specification and requirements.exe"
1⤵
PID:3068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 936
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3036-0-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

Filesize
4KB

Download
memory/3036-1-0x00000000051F0000-0x00000000051F1000-memory.dmp

Filesize
4KB

Download