e06e5ba87ec0ed09101fcd62c238777c90c6a59be6bba4ced6890250948e6a4b | Triage

Analysis

max time kernel
128s
max time network
131s
platform
windows10_x64
resource
win10
submitted
09-07-2020 07:38

Sharing

Report Analysis Logs

General

Target

m1pZYGiBFonndjG.exe
Size

1.0MB
MD5

5da5e488f088c67f1bc677baab5b75b8
SHA1

169b9253cfd6bfbf8a67e3e784b94e46dca4e58f
SHA256

e06e5ba87ec0ed09101fcd62c238777c90c6a59be6bba4ced6890250948e6a4b
SHA512

038e377d4651f539e81d7cf05d68612b8c82661926695441cb3987eb4a8f8e812ef428d9a89fdd8928682a2369bd0b273286a29ed8f1ffa3b8890dcd848d51a6

Score

3^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe
3836	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3836 2896 WerFault.exe m1pZYGiBFonndjG.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3836 WerFault.exe
Token: SeBackupPrivilege 3836 WerFault.exe
Token: SeDebugPrivilege 3836 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\m1pZYGiBFonndjG.exe
"C:\Users\Admin\AppData\Local\Temp\m1pZYGiBFonndjG.exe"
1⤵
PID:2896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1152
2⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3836-0-0x0000000005090000-0x0000000005091000-memory.dmp

Filesize
4KB

Download
memory/3836-1-0x00000000057D0000-0x00000000057D1000-memory.dmp

Filesize
4KB

Download