1216760b7cd8f2c6be3e6ddabaea8e1068faf26f97a5f9a1575a139904cd58d3 | Triage

Analysis

max time kernel
126s
max time network
150s
platform
windows10_x64
resource
win10v200430
submitted
08-07-2020 06:33

Sharing

Report Analysis Logs

General

Target

GHB08072020.exe
Size

1.2MB
MD5

c30cd0191fdbddd45e213a7b89256749
SHA1

54d240a372703587500ede18c1dc1bcf0c5972a6
SHA256

1216760b7cd8f2c6be3e6ddabaea8e1068faf26f97a5f9a1575a139904cd58d3
SHA512

b4eff82876ce64c8074e53e7921d5aee6afdd9b10c16297c5639f7d735bcc430429c260b3eacf92dc5ee9d114554f505efbe094ae2f7fd0b9a300b988a1ddbe4

Score

3^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe
2076	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2076 1612 WerFault.exe GHB08072020.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2076 WerFault.exe
Token: SeBackupPrivilege 2076 WerFault.exe
Token: SeDebugPrivilege 2076 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\GHB08072020.exe
"C:\Users\Admin\AppData\Local\Temp\GHB08072020.exe"
1⤵
PID:1612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 1148
2⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2076-0-0x0000000004E80000-0x0000000004E81000-memory.dmp

Filesize
4KB

Download
memory/2076-1-0x00000000056C0000-0x00000000056C1000-memory.dmp

Filesize
4KB

Download