Analysis
-
max time kernel
74s -
max time network
117s -
platform
windows10_x64 -
resource
win10 -
submitted
07-07-2020 17:27
Static task
static1
Behavioral task
behavioral1
Sample
INVOICE PDF.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
INVOICE PDF.exe
Resource
win10
0 signatures
0 seconds
General
-
Target
INVOICE PDF.exe
-
Size
556KB
-
MD5
7bfad62088a9d2186c233c0d346a58de
-
SHA1
e6e454a6ae42414dc03afd6f2fade5fdf1f72a52
-
SHA256
39c437d661ebd2816fb9228a00524a526abbfea18a3b17aba9a4abbfd7691045
-
SHA512
4dcc820ecf6dabf93f02011ec2bca8467040dbfde10bf84238b882274abfb4559c64ef66902db8cc7f6773d6d193f73de8d44095bc456d28d1ae656041aaef54
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3920 3788 WerFault.exe INVOICE PDF.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
WerFault.exepid process 3920 WerFault.exe 3920 WerFault.exe 3920 WerFault.exe 3920 WerFault.exe 3920 WerFault.exe 3920 WerFault.exe 3920 WerFault.exe 3920 WerFault.exe 3920 WerFault.exe 3920 WerFault.exe 3920 WerFault.exe 3920 WerFault.exe 3920 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 3920 WerFault.exe Token: SeBackupPrivilege 3920 WerFault.exe Token: SeDebugPrivilege 3920 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\INVOICE PDF.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE PDF.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3788 -s 9362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken