Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows10_x64 -
resource
win10 -
submitted
07-07-2020 18:10
Static task
static1
Behavioral task
behavioral1
Sample
f69a226eff787090505d361801a4a61d10658bde44759b9e5f80420e3e40e02f.exe
Resource
win7v200430
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
f69a226eff787090505d361801a4a61d10658bde44759b9e5f80420e3e40e02f.exe
Resource
win10
0 signatures
0 seconds
General
-
Target
f69a226eff787090505d361801a4a61d10658bde44759b9e5f80420e3e40e02f.exe
-
Size
306KB
-
MD5
33734974cdccb671d66899e0cca55d84
-
SHA1
e8cefa5364738a13c537b5b4efb0f6d00e207991
-
SHA256
f69a226eff787090505d361801a4a61d10658bde44759b9e5f80420e3e40e02f
-
SHA512
c392843a80a73693a166bef590a15b1a6c3cfc51f46e767a941ea74bedc177ca223c40196a661e4c7dd3fd85f8047c6ea3d07d2919f9798f0b1c04066410f069
Score
3/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
f69a226eff787090505d361801a4a61d10658bde44759b9e5f80420e3e40e02f.exeWerFault.exedescription pid process Token: SeDebugPrivilege 792 f69a226eff787090505d361801a4a61d10658bde44759b9e5f80420e3e40e02f.exe Token: SeRestorePrivilege 3688 WerFault.exe Token: SeBackupPrivilege 3688 WerFault.exe Token: SeDebugPrivilege 3688 WerFault.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
f69a226eff787090505d361801a4a61d10658bde44759b9e5f80420e3e40e02f.exeWerFault.exepid process 792 f69a226eff787090505d361801a4a61d10658bde44759b9e5f80420e3e40e02f.exe 3688 WerFault.exe 3688 WerFault.exe 3688 WerFault.exe 3688 WerFault.exe 3688 WerFault.exe 3688 WerFault.exe 3688 WerFault.exe 3688 WerFault.exe 3688 WerFault.exe 3688 WerFault.exe 3688 WerFault.exe 3688 WerFault.exe 3688 WerFault.exe 3688 WerFault.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3688 792 WerFault.exe f69a226eff787090505d361801a4a61d10658bde44759b9e5f80420e3e40e02f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f69a226eff787090505d361801a4a61d10658bde44759b9e5f80420e3e40e02f.exe"C:\Users\Admin\AppData\Local\Temp\f69a226eff787090505d361801a4a61d10658bde44759b9e5f80420e3e40e02f.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 792 -s 9682⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash