622070f03ea5a66037c38715ecce1ca6351148ab56ce6423fdafc13b383a4878 | Triage

Analysis

max time kernel
66s
max time network
74s
platform
windows10_x64
resource
win10
submitted
09-07-2020 12:34

Sharing

Report Analysis Logs

General

Target

622070f03ea5a66037c38715ecce1ca6351148ab56ce6423fdafc13b383a4878.exe
Size

6KB
MD5

7783211ed125bbe31cf50b47e9e96fbb
SHA1

b6b9c5effdd14e2920183b313c56e5068c57a709
SHA256

622070f03ea5a66037c38715ecce1ca6351148ab56ce6423fdafc13b383a4878
SHA512

9cebeb2eecc58edd86370e4967905f90655e6f4c6dad982f659c9ab2bf05ceb285d07bc21abbb8d0607566225bbb2e97366eda5bb40091a6b468227ea319f30c

Score

3^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

622070f03ea5a66037c38715ecce1ca6351148ab56ce6423fdafc13b383a4878.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	3068	622070f03ea5a66037c38715ecce1ca6351148ab56ce6423fdafc13b383a4878.exe
Token: SeRestorePrivilege	3956	WerFault.exe
Token: SeBackupPrivilege	3956	WerFault.exe
Token: SeDebugPrivilege	3956	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3956 3068 WerFault.exe 622070f03ea5a66037c38715ecce1ca6351148ab56ce6423fdafc13b383a4878.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3956	WerFault.exe
3956	WerFault.exe
3956	WerFault.exe
3956	WerFault.exe
3956	WerFault.exe
3956	WerFault.exe
3956	WerFault.exe
3956	WerFault.exe
3956	WerFault.exe
3956	WerFault.exe
3956	WerFault.exe
3956	WerFault.exe
3956	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\622070f03ea5a66037c38715ecce1ca6351148ab56ce6423fdafc13b383a4878.exe
"C:\Users\Admin\AppData\Local\Temp\622070f03ea5a66037c38715ecce1ca6351148ab56ce6423fdafc13b383a4878.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 776
2⤵
- Suspicious use of AdjustPrivilegeToken
- Program crash
- Suspicious behavior: EnumeratesProcesses
PID:3956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3956-0-0x00000000049F0000-0x00000000049F1000-memory.dmp

Filesize
4KB

Download
memory/3956-1-0x0000000005020000-0x0000000005021000-memory.dmp

Filesize
4KB

Download