Analysis
-
max time kernel
66s -
max time network
110s -
platform
windows10_x64 -
resource
win10 -
submitted
08-07-2020 16:46
Static task
static1
Behavioral task
behavioral1
Sample
EQUIP MATERIALS.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
EQUIP MATERIALS.exe
Resource
win10
0 signatures
0 seconds
General
-
Target
EQUIP MATERIALS.exe
-
Size
881KB
-
MD5
e837aefc96308f476f9c9fee984f0128
-
SHA1
4bae17624832e3c8928e4ae90a89c1868933620d
-
SHA256
f83df92f9d78101b5376837923351b70eb6581d4ee2b7bf251ef8a2387177064
-
SHA512
2c4178cd76546f54578bcf40c1f1ea0fed50b0fc7056d29df4005da8e88d14828f0120dccef2acf447cc7807d3ead898db87dd7b35f5c83a16d6e52a6a7ff51c
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3268 3588 WerFault.exe EQUIP MATERIALS.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
WerFault.exepid process 3268 WerFault.exe 3268 WerFault.exe 3268 WerFault.exe 3268 WerFault.exe 3268 WerFault.exe 3268 WerFault.exe 3268 WerFault.exe 3268 WerFault.exe 3268 WerFault.exe 3268 WerFault.exe 3268 WerFault.exe 3268 WerFault.exe 3268 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 3268 WerFault.exe Token: SeBackupPrivilege 3268 WerFault.exe Token: SeDebugPrivilege 3268 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\EQUIP MATERIALS.exe"C:\Users\Admin\AppData\Local\Temp\EQUIP MATERIALS.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 11442⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken