5cf10faa1d3568be564f096b940d45f2016b5f27289c72e03defe2dabc7e4670 | Triage

Analysis

max time kernel
77s
max time network
120s
platform
windows10_x64
resource
win10
submitted
07/07/2020, 12:12

Sharing

Report Analysis Logs

General

Target

3eJYx791KGJwBky.exe
Size

634KB
MD5

bdf0bd829a591a7786fa902c788a0590
SHA1

5284c7b945df828ad036fd604a3aee3cb0fb2555
SHA256

5cf10faa1d3568be564f096b940d45f2016b5f27289c72e03defe2dabc7e4670
SHA512

e7fceaa3be3ac71be49dbe8737ac19bec0fe96643336fa2e2978395ba8c1910349aa9df68b3a2ab1831da36633e8b214f2b0fd6ff149e4ba382dc5e9bc7e64d6

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3240	3100	WerFault.exe	66

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3240	WerFault.exe
Token: SeBackupPrivilege	3240	WerFault.exe
Token: SeDebugPrivilege	3240	WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe
3240	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\3eJYx791KGJwBky.exe
"C:\Users\Admin\AppData\Local\Temp\3eJYx791KGJwBky.exe"
1⤵
PID:3100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 936
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:3240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3240-0-0x0000000004A20000-0x0000000004A21000-memory.dmp

Filesize
4KB

Download
memory/3240-1-0x0000000004F60000-0x0000000004F61000-memory.dmp

Filesize
4KB

Download