3e5ee9e4d00a17bd606a38740500770ddc552e664e3b02770d9897b3ba4423b3 | Triage

Analysis

max time kernel
135s
max time network
138s
platform
windows10_x64
resource
win10
submitted
09-07-2020 08:27

Sharing

Report Analysis Logs

General

Target

PO_287109139.exe
Size

737KB
MD5

5df31efe4011afb75d9fddbc55387de0
SHA1

f6eee466fb7425254f0884dbb5c49e3849eadef1
SHA256

3e5ee9e4d00a17bd606a38740500770ddc552e664e3b02770d9897b3ba4423b3
SHA512

98f4877b25a2fb81cd4304351274be959c9059576a0fdd72a359f9f024060e27261f3a36b06ee4e4080e85d09136587a4f2d260c56ea0f43f3528cfbfbcefd21

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3456 3108 WerFault.exe PO_287109139.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3456	WerFault.exe
3456	WerFault.exe
3456	WerFault.exe
3456	WerFault.exe
3456	WerFault.exe
3456	WerFault.exe
3456	WerFault.exe
3456	WerFault.exe
3456	WerFault.exe
3456	WerFault.exe
3456	WerFault.exe
3456	WerFault.exe
3456	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3456 WerFault.exe
Token: SeBackupPrivilege 3456 WerFault.exe
Token: SeDebugPrivilege 3456 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\PO_287109139.exe
"C:\Users\Admin\AppData\Local\Temp\PO_287109139.exe"
1⤵
PID:3108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 1148
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3456-0-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

Filesize
4KB

Download
memory/3456-1-0x00000000055E0000-0x00000000055E1000-memory.dmp

Filesize
4KB

Download