1a74ccf719aa43c97835fd2bd03de4c85d4d4eaad56482b8d4d70e3f8beac769 | Triage

Analysis

max time kernel
132s
max time network
137s
platform
windows10_x64
resource
win10
submitted
07-07-2020 17:26

Sharing

Report Analysis Logs

General

Target

Rev Cont CD20(3) SC# IDM392(20) SC# - DRB.exe
Size

598KB
MD5

21d3d4a548696aac6bbe682a8e745213
SHA1

58ead3fe064635fe331fb5d6788a9b27f2ddcf74
SHA256

1a74ccf719aa43c97835fd2bd03de4c85d4d4eaad56482b8d4d70e3f8beac769
SHA512

63ec84ab4754a26659f83e26e38921074f19a38a7d23e41d15d4f159c5cf2d37395e946b57c4a4462abfea44f78cc2dc0155adbece076e40ce445f0ecf0de38b

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3868 4092 WerFault.exe Rev Cont CD20(3) SC# IDM392(20) SC# - DRB.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe
3868	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3868 WerFault.exe
Token: SeBackupPrivilege 3868 WerFault.exe
Token: SeDebugPrivilege 3868 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Rev Cont CD20(3) SC# IDM392(20) SC# - DRB.exe
"C:\Users\Admin\AppData\Local\Temp\Rev Cont CD20(3) SC# IDM392(20) SC# - DRB.exe"
1⤵
PID:4092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 944
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3868-0-0x0000000004920000-0x0000000004921000-memory.dmp

Filesize
4KB

Download
memory/3868-1-0x0000000004EE0000-0x0000000004EE1000-memory.dmp

Filesize
4KB

Download