6268fb65bb438f3574d4e4c82988071d3dfe3951177c8db5901c405e1a729b5c | Triage

Analysis

max time kernel
149s
max time network
34s
platform
windows7_x64
resource
win7v200430
submitted
09-07-2020 13:45

Sharing

Report Analysis Logs

General

Target

6268fb65bb438f3574d4e4c82988071d3dfe3951177c8db5901c405e1a729b5c.exe
Size

5KB
MD5

c6c7b95620352a1df10b834d94c6c03d
SHA1

396d24c5b4e28a6313e11c498df8cb8a8876ac9a
SHA256

6268fb65bb438f3574d4e4c82988071d3dfe3951177c8db5901c405e1a729b5c
SHA512

4399ce0d7bdef51540da08ed25f00421896df239d306228a58460768b12581d1e79ed5f3bba8da7961b08af9db8bb95e6edeb22abf724ebe94a0debe687434f0

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

904 880 WerFault.exe 6268fb65bb438f3574d4e4c82988071d3dfe3951177c8db5901c405e1a729b5c.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

6268fb65bb438f3574d4e4c82988071d3dfe3951177c8db5901c405e1a729b5c.exe

description	pid	process	target process
PID 880 wrote to memory of 904	880	6268fb65bb438f3574d4e4c82988071d3dfe3951177c8db5901c405e1a729b5c.exe	WerFault.exe
PID 880 wrote to memory of 904	880	6268fb65bb438f3574d4e4c82988071d3dfe3951177c8db5901c405e1a729b5c.exe	WerFault.exe
PID 880 wrote to memory of 904	880	6268fb65bb438f3574d4e4c82988071d3dfe3951177c8db5901c405e1a729b5c.exe	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 904 WerFault.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

904 WerFault.exe
904 WerFault.exe
904 WerFault.exe
904 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

904 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\6268fb65bb438f3574d4e4c82988071d3dfe3951177c8db5901c405e1a729b5c.exe
"C:\Users\Admin\AppData\Local\Temp\6268fb65bb438f3574d4e4c82988071d3dfe3951177c8db5901c405e1a729b5c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:880

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 880 -s 612
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/904-0-0x0000000000000000-mapping.dmp

Download
memory/904-1-0x0000000001E90000-0x0000000001EA1000-memory.dmp

Filesize
68KB

Download
memory/904-2-0x0000000002B00000-0x0000000002B11000-memory.dmp

Filesize
68KB

Download