7ef397f325081c95cf955982b820684a4f506bfc12d281b6423ca8a4d0140b93 | Triage

Analysis

max time kernel
77s
max time network
135s
platform
windows10_x64
resource
win10
submitted
08-07-2020 12:54

Sharing

Report Analysis Logs

General

Target

New_PO00002030303.exe
Size

786KB
MD5

751b07e49af55d9368d2aec61fa8bad9
SHA1

d2ebc1ead70dd8cb19e634a7c4eabb866286b7d9
SHA256

7ef397f325081c95cf955982b820684a4f506bfc12d281b6423ca8a4d0140b93
SHA512

158e902fcd3c7bca7140efb879e94a21d45bbad0301a948f30bb275b4a200dbb6dcbad54d30e293c2fbfa81c6b788b70c09455b05b4360aede2260522808ae58

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3872 720 WerFault.exe New_PO00002030303.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3872 WerFault.exe
Token: SeBackupPrivilege 3872 WerFault.exe
Token: SeDebugPrivilege 3872 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe
3872	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\New_PO00002030303.exe
"C:\Users\Admin\AppData\Local\Temp\New_PO00002030303.exe"
1⤵
PID:720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 720 -s 1144
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3872-0-0x00000000047A0000-0x00000000047A1000-memory.dmp

Filesize
4KB

Download
memory/3872-1-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

Filesize
4KB

Download