f83df92f9d78101b5376837923351b70eb6581d4ee2b7bf251ef8a2387177064 | Triage

Analysis

max time kernel
66s
max time network
110s
platform
windows10_x64
resource
win10
submitted
08-07-2020 16:46

Sharing

Report Analysis Logs

General

Target

EQUIP MATERIALS.exe
Size

881KB
MD5

e837aefc96308f476f9c9fee984f0128
SHA1

4bae17624832e3c8928e4ae90a89c1868933620d
SHA256

f83df92f9d78101b5376837923351b70eb6581d4ee2b7bf251ef8a2387177064
SHA512

2c4178cd76546f54578bcf40c1f1ea0fed50b0fc7056d29df4005da8e88d14828f0120dccef2acf447cc7807d3ead898db87dd7b35f5c83a16d6e52a6a7ff51c

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3268 3588 WerFault.exe EQUIP MATERIALS.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe
3268	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3268 WerFault.exe
Token: SeBackupPrivilege 3268 WerFault.exe
Token: SeDebugPrivilege 3268 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\EQUIP MATERIALS.exe
"C:\Users\Admin\AppData\Local\Temp\EQUIP MATERIALS.exe"
1⤵
PID:3588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1144
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3268-0-0x00000000047C0000-0x00000000047C1000-memory.dmp

Filesize
4KB

Download
memory/3268-1-0x0000000004E00000-0x0000000004E01000-memory.dmp

Filesize
4KB

Download