cd759300c8e46a70f35f4242e75b987beb809b89f244d7a7235dc33b868e245f | Triage

Analysis

max time kernel
135s
max time network
104s
platform
windows10_x64
resource
win10v200430
submitted
08-07-2020 12:11

Sharing

Report Analysis Logs

General

Target

cd759300c8e46a70f35f4242e75b987beb809b89f244d7a7235dc33b868e245f.exe
Size

224KB
MD5

de8e255db63ba62ce08aafcada997a76
SHA1

d0c19ad11433c5528e6f4c46a34b271d34cfcef7
SHA256

cd759300c8e46a70f35f4242e75b987beb809b89f244d7a7235dc33b868e245f
SHA512

ff10b8b5d6117f689b8cbf9acb083d353407fadcc3351a5dba6fa44ca6b58967f30ce4bd8da1545fa8fbb6b226b7ed4e93725e5b3b5ef17fbb7539d0122d9d74

Score

3^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
2764	WerFault.exe
2764	WerFault.exe
2764	WerFault.exe
2764	WerFault.exe
2764	WerFault.exe
2764	WerFault.exe
2764	WerFault.exe
2764	WerFault.exe
2764	WerFault.exe
2764	WerFault.exe
2764	WerFault.exe
2764	WerFault.exe
2764	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2764 912 WerFault.exe cd759300c8e46a70f35f4242e75b987beb809b89f244d7a7235dc33b868e245f.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2764 WerFault.exe
Token: SeBackupPrivilege 2764 WerFault.exe
Token: SeDebugPrivilege 2764 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\cd759300c8e46a70f35f4242e75b987beb809b89f244d7a7235dc33b868e245f.exe
"C:\Users\Admin\AppData\Local\Temp\cd759300c8e46a70f35f4242e75b987beb809b89f244d7a7235dc33b868e245f.exe"
1⤵
PID:912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 912 -s 932
2⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2764-0-0x00000000042C0000-0x00000000042C1000-memory.dmp

Filesize
4KB

Download
memory/2764-2-0x0000000004800000-0x0000000004801000-memory.dmp

Filesize
4KB

Download