5523b6368db651832484529a46f8c4ce6661b4770e10081937b4014c97c2197a | Triage

Analysis

max time kernel
64s
max time network
98s
platform
windows10_x64
resource
win10
submitted
09-07-2020 18:27

Sharing

Report Analysis Logs

General

Target

ZgPNRmA9FUAPwwl.exe
Size

568KB
MD5

605e2e137b27ca373e5768af5258559d
SHA1

6e393919835cb22412c61194ce4915907b41ec35
SHA256

5523b6368db651832484529a46f8c4ce6661b4770e10081937b4014c97c2197a
SHA512

0207b0410b93731aff0665cab42a7d493e79c3d111fe8b229190ace10da613879426d1e2d9c4778073e379cdfb610212bc2d14a65b51042e18929c364b155699

Score

3^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3824	WerFault.exe
3824	WerFault.exe
3824	WerFault.exe
3824	WerFault.exe
3824	WerFault.exe
3824	WerFault.exe
3824	WerFault.exe
3824	WerFault.exe
3824	WerFault.exe
3824	WerFault.exe
3824	WerFault.exe
3824	WerFault.exe
3824	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3824 3104 WerFault.exe ZgPNRmA9FUAPwwl.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3824 WerFault.exe
Token: SeBackupPrivilege 3824 WerFault.exe
Token: SeDebugPrivilege 3824 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ZgPNRmA9FUAPwwl.exe
"C:\Users\Admin\AppData\Local\Temp\ZgPNRmA9FUAPwwl.exe"
1⤵
PID:3104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 912
2⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3824-0-0x0000000004F00000-0x0000000004F01000-memory.dmp

Filesize
4KB

Download
memory/3824-1-0x00000000054C0000-0x00000000054C1000-memory.dmp

Filesize
4KB

Download