3f354781f665a6a9064df443b5f61f3c0db884d94f14e34fd957b0d7548fa7f0 | Triage

Analysis

max time kernel
75s
max time network
134s
platform
windows10_x64
resource
win10
submitted
07-07-2020 11:40

Sharing

Report Analysis Logs

General

Target

vbc(26).exe
Size

557KB
MD5

5172f944e8874206da2ddbc6959cacb7
SHA1

22958bfde97aaab9e6c844d944104d9ce8140ebf
SHA256

3f354781f665a6a9064df443b5f61f3c0db884d94f14e34fd957b0d7548fa7f0
SHA512

25a2b1063f600e2e65d58f783b64f2ac11b6321da6e4c6f629d795d3443fbec136c973c8bb1871932c8fafa1feb4e16ac028c755c9deb685d5235fe026f5fa27

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3792 3620 WerFault.exe vbc(26).exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3792 WerFault.exe
Token: SeBackupPrivilege 3792 WerFault.exe
Token: SeDebugPrivilege 3792 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\vbc(26).exe
"C:\Users\Admin\AppData\Local\Temp\vbc(26).exe"
1⤵
PID:3620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 936
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3792-0-0x0000000004660000-0x0000000004661000-memory.dmp

Filesize
4KB

Download
memory/3792-1-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

Filesize
4KB

Download