8109e1b1ea98b06d4e7eb7753b6a17ed3670c959859e543fbeace72f96bbc1fd | Triage

Analysis

max time kernel
136s
max time network
137s
platform
windows10_x64
resource
win10
submitted
09-07-2020 13:46

Sharing

Report Analysis Logs

General

Target

8109e1b1ea98b06d4e7eb7753b6a17ed3670c959859e543fbeace72f96bbc1fd.exe
Size

6KB
MD5

56a237b110e6372c174ac23c9e5b7602
SHA1

8fe983d58a22b447fd76b8a7ce5ef15d1b4341d3
SHA256

8109e1b1ea98b06d4e7eb7753b6a17ed3670c959859e543fbeace72f96bbc1fd
SHA512

e1facf22a981a5ea30b3bcae1fc2772bda0a44c663c9b17d1784a1e0447236b3ed6f267bcf50fb16980aea74d681891a10871252fb51f13ed1f203df4bbef7f9

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3936	3588	WerFault.exe	66

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3936	WerFault.exe
Token: SeBackupPrivilege	3936	WerFault.exe
Token: SeDebugPrivilege	3936	WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe
3936	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\8109e1b1ea98b06d4e7eb7753b6a17ed3670c959859e543fbeace72f96bbc1fd.exe
"C:\Users\Admin\AppData\Local\Temp\8109e1b1ea98b06d4e7eb7753b6a17ed3670c959859e543fbeace72f96bbc1fd.exe"
1⤵
PID:3588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1004
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:3936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3936-0-0x0000000004880000-0x0000000004881000-memory.dmp

Filesize
4KB

Download
memory/3936-1-0x0000000004CC0000-0x0000000004CC1000-memory.dmp

Filesize
4KB

Download