73a4e945a1c898ac6a48f8359785c4bd85a1e9af7423db4bd18149c428503cb2 | Triage

Analysis

max time kernel
86s
max time network
98s
platform
windows10_x64
resource
win10
submitted
07/07/2020, 10:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

DHL-#AWB130501923096.pdf.exe
Size

568KB
MD5

b70d92034cfc3f3015f270e306d6a1e5
SHA1

5281550bb31582b06cde9c9cbf11ba4c98fc1d03
SHA256

73a4e945a1c898ac6a48f8359785c4bd85a1e9af7423db4bd18149c428503cb2
SHA512

a17a0338f2789b04ad95afe7a4f80c1e812d8009376e2788da626dfe26a5f8bca17d115047cae30ccdee856968995ec22ec767fead8ed6bb2dc12531fb7cc51f

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3856	3676	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe
3856	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3856	WerFault.exe
Token: SeBackupPrivilege	3856	WerFault.exe
Token: SeDebugPrivilege	3856	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\DHL-#AWB130501923096.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\DHL-#AWB130501923096.pdf.exe"
1⤵
PID:3676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 936
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3856-0-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

Filesize
4KB

Download
memory/3856-1-0x00000000053E0000-0x00000000053E1000-memory.dmp

Filesize
4KB

Download