2b677efbb2d332ea0a8fe453281fa6013bf223e7897d8419f98b13e5fbf48615 | Triage

Analysis

max time kernel
122s
max time network
125s
platform
windows10_x64
resource
win10v200430
submitted
07-07-2020 06:27

Sharing

Report Analysis Logs

General

Target

4d1058703a7baefeee2f1bf88e3829a8.exe
Size

659KB
MD5

4d1058703a7baefeee2f1bf88e3829a8
SHA1

c94d3406a30980abb3cd47aec0a4282f686bf6ef
SHA256

2b677efbb2d332ea0a8fe453281fa6013bf223e7897d8419f98b13e5fbf48615
SHA512

4e7500edf703b513c947a518f8af2058a578099bacaf69010ce444da8c3cc7bc34342b3ddbbed4be7ca6a23a0ee66c3b2d835f9c093ad5d1724f513b0962ada7

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

900 3144 WerFault.exe 4d1058703a7baefeee2f1bf88e3829a8.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

4d1058703a7baefeee2f1bf88e3829a8.exeWerFault.exe

pid	process
3144	4d1058703a7baefeee2f1bf88e3829a8.exe
900	WerFault.exe
900	WerFault.exe
900	WerFault.exe
900	WerFault.exe
900	WerFault.exe
900	WerFault.exe
900	WerFault.exe
900	WerFault.exe
900	WerFault.exe
900	WerFault.exe
900	WerFault.exe
900	WerFault.exe
900	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

4d1058703a7baefeee2f1bf88e3829a8.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	3144	4d1058703a7baefeee2f1bf88e3829a8.exe
Token: SeRestorePrivilege	900	WerFault.exe
Token: SeBackupPrivilege	900	WerFault.exe
Token: SeDebugPrivilege	900	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\4d1058703a7baefeee2f1bf88e3829a8.exe
"C:\Users\Admin\AppData\Local\Temp\4d1058703a7baefeee2f1bf88e3829a8.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 952
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/900-0-0x00000000047E0000-0x00000000047E1000-memory.dmp

Filesize
4KB

Download
memory/900-1-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

Filesize
4KB

Download