7cda3d1fc34239f1a7a85090ae4942ffe012e1f5e6dec7431062797c4d9b8c6e | Triage

Analysis

max time kernel
129s
max time network
101s
platform
windows10_x64
resource
win10v200430
submitted
08-07-2020 10:04

Sharing

Report Analysis Logs

General

Target

FNwAtLNfYETXwOA.exe
Size

900KB
MD5

afa3258c4d320535914b01dd4c8a2e60
SHA1

2db45e6696bf224d026aef2c20451c463745edfc
SHA256

7cda3d1fc34239f1a7a85090ae4942ffe012e1f5e6dec7431062797c4d9b8c6e
SHA512

aeefab81537d24433eb17462047a5d5d4dc21603011cdf4828da13e8fa0b94097a2835f2798270bf12d515d3fb272c5bbba6680226e7969c3bf2a2a13e5b53a7

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2736 1500 WerFault.exe FNwAtLNfYETXwOA.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
2736	WerFault.exe
2736	WerFault.exe
2736	WerFault.exe
2736	WerFault.exe
2736	WerFault.exe
2736	WerFault.exe
2736	WerFault.exe
2736	WerFault.exe
2736	WerFault.exe
2736	WerFault.exe
2736	WerFault.exe
2736	WerFault.exe
2736	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2736 WerFault.exe
Token: SeBackupPrivilege 2736 WerFault.exe
Token: SeDebugPrivilege 2736 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\FNwAtLNfYETXwOA.exe
"C:\Users\Admin\AppData\Local\Temp\FNwAtLNfYETXwOA.exe"
1⤵
PID:1500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 1152
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2736-0-0x0000000004B30000-0x0000000004B31000-memory.dmp

Filesize
4KB

Download
memory/2736-1-0x0000000005270000-0x0000000005271000-memory.dmp

Filesize
4KB

Download