fb28a89e1067428e1cd2c8fd9d41d297a09e5e1f6a1698f70d56871a49f8bc51 | Triage

Analysis

max time kernel
147s
max time network
97s
platform
windows10_x64
resource
win10v200430
submitted
08/07/2020, 06:33

Sharing

Report Analysis Logs

General

Target

rlJPEcInJxOdLje.exe
Size

852KB
MD5

07817c3519548de3be1d127fabdb7ec6
SHA1

e8aac6b4a4bda400e035e9abce8005840150bcdd
SHA256

fb28a89e1067428e1cd2c8fd9d41d297a09e5e1f6a1698f70d56871a49f8bc51
SHA512

f4e4a44d5ada100f7f0535cdb40850987eb1501fd76665c28e9bed81cdafa07c9b8ebd2271972b783327033433ed02049d348adeb3e308a8a9127970c1049719

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2184	3768	WerFault.exe	65

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2184	WerFault.exe
2184	WerFault.exe
2184	WerFault.exe
2184	WerFault.exe
2184	WerFault.exe
2184	WerFault.exe
2184	WerFault.exe
2184	WerFault.exe
2184	WerFault.exe
2184	WerFault.exe
2184	WerFault.exe
2184	WerFault.exe
2184	WerFault.exe
2184	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2184	WerFault.exe
Token: SeBackupPrivilege	2184	WerFault.exe
Token: SeDebugPrivilege	2184	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\rlJPEcInJxOdLje.exe
"C:\Users\Admin\AppData\Local\Temp\rlJPEcInJxOdLje.exe"
1⤵
PID:3768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 1148
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2184-0-0x0000000004370000-0x0000000004371000-memory.dmp

Filesize
4KB

Download
memory/2184-1-0x0000000004AB0000-0x0000000004AB1000-memory.dmp

Filesize
4KB

Download