d77164b07cd8222d61dd3918911dc322acb6f08d90802d68b554ff436056c59e | Triage

Analysis

max time kernel
66s
max time network
124s
platform
windows10_x64
resource
win10
submitted
07-07-2020 06:01

Sharing

Report Analysis Logs

General

Target

9041696cf873f24254e74a0b67c8485a.exe
Size

209KB
MD5

9041696cf873f24254e74a0b67c8485a
SHA1

8d45756857d594b433f475dc34a4c8756c6b95a2
SHA256

d77164b07cd8222d61dd3918911dc322acb6f08d90802d68b554ff436056c59e
SHA512

24e31e96a96924c211d3820f94e37d094af20e045489fe584b7a947c81850f20a586de8bc566859199265043adb8348e299e56cca845b7b0bf3f16e19035ad16

Score

3^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3848 WerFault.exe
Token: SeBackupPrivilege 3848 WerFault.exe
Token: SeDebugPrivilege 3848 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3848	WerFault.exe
3848	WerFault.exe
3848	WerFault.exe
3848	WerFault.exe
3848	WerFault.exe
3848	WerFault.exe
3848	WerFault.exe
3848	WerFault.exe
3848	WerFault.exe
3848	WerFault.exe
3848	WerFault.exe
3848	WerFault.exe
3848	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3848 3748 WerFault.exe 9041696cf873f24254e74a0b67c8485a.exe

C:\Users\Admin\AppData\Local\Temp\9041696cf873f24254e74a0b67c8485a.exe
"C:\Users\Admin\AppData\Local\Temp\9041696cf873f24254e74a0b67c8485a.exe"
1⤵
PID:3748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3748 -s 1152
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash
PID:3848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3848-0-0x00000000049F0000-0x00000000049F1000-memory.dmp

Filesize
4KB

Download
memory/3848-1-0x0000000005030000-0x0000000005031000-memory.dmp

Filesize
4KB

Download
memory/3848-10-0x0000000005430000-0x0000000005431000-memory.dmp

Filesize
4KB

Download