Analysis
-
max time kernel
74s -
max time network
117s -
platform
windows10_x64 -
resource
win10 -
submitted
07/07/2020, 06:09
Static task
static1
Behavioral task
behavioral1
Sample
655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
Resource
win7v200430
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
Resource
win10
0 signatures
0 seconds
General
-
Target
655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe
-
Size
294KB
-
MD5
a42e195a8a3de45dc2bc88e33af006a4
-
SHA1
1ce81ed627893bb2cb4aa83b008dcd10c9203dae
-
SHA256
655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66
-
SHA512
2a08c7e3110e080d2377e7e25f7cc3f1ff936ceb5e59f5f763955578b68cafe10b8d260a6b3147d0bd6d127774a298181bca8ad6256f40a42318df31756de90c
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3916 3700 WerFault.exe 66 -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 3916 WerFault.exe Token: SeBackupPrivilege 3916 WerFault.exe Token: SeDebugPrivilege 3916 WerFault.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 3916 WerFault.exe 3916 WerFault.exe 3916 WerFault.exe 3916 WerFault.exe 3916 WerFault.exe 3916 WerFault.exe 3916 WerFault.exe 3916 WerFault.exe 3916 WerFault.exe 3916 WerFault.exe 3916 WerFault.exe 3916 WerFault.exe 3916 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe"C:\Users\Admin\AppData\Local\Temp\655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66.exe"1⤵PID:3700
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 11602⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3916
-