7dd7eec0cd54380999e726084d59c93a21119539d5c56046e347bbce63c88c5e | Triage

Analysis

max time kernel
138s
max time network
84s
platform
windows10_x64
resource
win10v200430
submitted
09/07/2020, 13:43

Sharing

Report Analysis Logs

General

Target

7dd7eec0cd54380999e726084d59c93a21119539d5c56046e347bbce63c88c5e.exe
Size

4KB
MD5

5d72085ee51fb7850533c9247bc12b3f
SHA1

7dac07ad9d922fbb7ec94de67f16eca152391c51
SHA256

7dd7eec0cd54380999e726084d59c93a21119539d5c56046e347bbce63c88c5e
SHA512

bbd180c01c44456c76f8a6f1fb489a162b6f3effe57b19fadc183949ef44417b234d309638b7fe092e62ad9ac2f18ff32771160c98cd0ebb662024ffd971530e

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2632	3576	WerFault.exe	65

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2632	WerFault.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2632	WerFault.exe
2632	WerFault.exe
2632	WerFault.exe
2632	WerFault.exe
2632	WerFault.exe
2632	WerFault.exe
2632	WerFault.exe
2632	WerFault.exe
2632	WerFault.exe
2632	WerFault.exe
2632	WerFault.exe
2632	WerFault.exe
2632	WerFault.exe
2632	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\7dd7eec0cd54380999e726084d59c93a21119539d5c56046e347bbce63c88c5e.exe
"C:\Users\Admin\AppData\Local\Temp\7dd7eec0cd54380999e726084d59c93a21119539d5c56046e347bbce63c88c5e.exe"
1⤵
PID:3576
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3576 -s 952
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:2632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2632-0-0x000001A2DDD10000-0x000001A2DDD11000-memory.dmp

Filesize
4KB

Download
memory/2632-1-0x000001A2DEA80000-0x000001A2DEA81000-memory.dmp

Filesize
4KB

Download
memory/2632-2-0x000001A2DEA80000-0x000001A2DEA81000-memory.dmp

Filesize
4KB

Download