4b946d9a4de3fef939ea0ef122aa66dc90ccd66f9d842ad8adc0e0038f0c47ea | Triage

Analysis

max time kernel
125s
max time network
128s
platform
windows10_x64
resource
win10
submitted
07-07-2020 08:24

Sharing

Report Analysis Logs

General

Target

a9ed23836eea2535687ed15da8137b73.exe
Size

659KB
MD5

a9ed23836eea2535687ed15da8137b73
SHA1

4974869cf27d011785ea67c8fa7f509cac7fca04
SHA256

4b946d9a4de3fef939ea0ef122aa66dc90ccd66f9d842ad8adc0e0038f0c47ea
SHA512

932d23b71ed131b1814af18cdf82dc6b08486956d6712f39d0c8696d5026ae56ae9c7145e1449612d0592620a49e6e1b97ac444e68d3bcdaa447c5a2bfa61a4c

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3936 2880 WerFault.exe a9ed23836eea2535687ed15da8137b73.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

a9ed23836eea2535687ed15da8137b73.exeWerFault.exe

pid	process
2880	a9ed23836eea2535687ed15da8137b73.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

a9ed23836eea2535687ed15da8137b73.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	2880	a9ed23836eea2535687ed15da8137b73.exe
Token: SeRestorePrivilege	3936	WerFault.exe
Token: SeBackupPrivilege	3936	WerFault.exe
Token: SeDebugPrivilege	3936	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\a9ed23836eea2535687ed15da8137b73.exe
"C:\Users\Admin\AppData\Local\Temp\a9ed23836eea2535687ed15da8137b73.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 936
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3936-0-0x0000000004810000-0x0000000004811000-memory.dmp

Filesize
4KB

Download
memory/3936-1-0x0000000005050000-0x0000000005051000-memory.dmp

Filesize
4KB

Download