69ea320678acca63c52c05f9d51fb2ed84a6e454b0925bdf7d4a40d70f083bdc | Triage

Analysis

max time kernel
62s
max time network
113s
platform
windows10_x64
resource
win10
submitted
09-07-2020 16:16

Sharing

Report Analysis Logs

General

Target

july9o.exe
Size

610KB
MD5

2a22ab4eba2aefb03b467815ea4c6ac5
SHA1

58e305aeafba39f4b6b40195e968f47e43461b3d
SHA256

69ea320678acca63c52c05f9d51fb2ed84a6e454b0925bdf7d4a40d70f083bdc
SHA512

b495020e62a6a65ebfee310e5fef95c168d2bbd7e1e256fc48832b6d4415e33b12c2b56d9a4baf54f8d56703c9e5884e4b212c68fe0fc747f4d98f8ce15ade12

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
756	4036	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4036	july9o.exe
756	WerFault.exe
756	WerFault.exe
756	WerFault.exe
756	WerFault.exe
756	WerFault.exe
756	WerFault.exe
756	WerFault.exe
756	WerFault.exe
756	WerFault.exe
756	WerFault.exe
756	WerFault.exe
756	WerFault.exe
756	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4036	july9o.exe
Token: SeRestorePrivilege	756	WerFault.exe
Token: SeBackupPrivilege	756	WerFault.exe
Token: SeDebugPrivilege	756	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\july9o.exe
"C:\Users\Admin\AppData\Local\Temp\july9o.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4036 -s 1264
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/756-0-0x0000000004940000-0x0000000004941000-memory.dmp

Filesize
4KB

Download
memory/756-1-0x0000000005080000-0x0000000005081000-memory.dmp

Filesize
4KB

Download