151caa538da3b32889f7aa47133860846700a816b902f5eeac6bb39d795c6812 | Triage

Analysis

max time kernel
137s
max time network
98s
platform
windows10_x64
resource
win10v200430
submitted
08-07-2020 07:46

Sharing

Report Analysis Logs

General

Target

uT5wiEYASje8CME.exe
Size

580KB
MD5

1fa18abde13192d33d6347abe0bf734e
SHA1

875fe32e6e14889fc7b473e91f070d46999ed07a
SHA256

151caa538da3b32889f7aa47133860846700a816b902f5eeac6bb39d795c6812
SHA512

6cd32bd88d26ef9e9a10243f2e6db14ceab354dd102ec15764c11d440f3458ca9f75d065c2f3763b74669bda57465f1a3c67a47f16346093ec284b5768f2e450

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2980	652	WerFault.exe	65

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2980	WerFault.exe
Token: SeBackupPrivilege	2980	WerFault.exe
Token: SeDebugPrivilege	2980	WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2980	WerFault.exe
2980	WerFault.exe
2980	WerFault.exe
2980	WerFault.exe
2980	WerFault.exe
2980	WerFault.exe
2980	WerFault.exe
2980	WerFault.exe
2980	WerFault.exe
2980	WerFault.exe
2980	WerFault.exe
2980	WerFault.exe
2980	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\uT5wiEYASje8CME.exe
"C:\Users\Admin\AppData\Local\Temp\uT5wiEYASje8CME.exe"
1⤵
PID:652
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 936
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:2980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2980-0-0x00000000044C0000-0x00000000044C1000-memory.dmp

Filesize
4KB

Download
memory/2980-1-0x0000000004A00000-0x0000000004A01000-memory.dmp

Filesize
4KB

Download
memory/2980-10-0x0000000004E00000-0x0000000004E01000-memory.dmp

Filesize
4KB

Download