c4031838bc163076ff2845546cad4c409d9cec8a2100d78d4ea1ea75579f7c37 | Triage

Analysis

max time kernel
122s
max time network
117s
platform
windows10_x64
resource
win10
submitted
09-07-2020 13:22

Sharing

Report Analysis Logs

General

Target

NEW requirement.exe
Size

735KB
MD5

d4b9f6bbb9325e1a23d299c0e1399935
SHA1

8c23967805c380f4aec14de92c533a4f95542341
SHA256

c4031838bc163076ff2845546cad4c409d9cec8a2100d78d4ea1ea75579f7c37
SHA512

b88b75c0211a2f8835dc519e579b7c0b2c7fe52bf1a108da005efb17917055dab53d379a8a2aa902e460a8fc10f381f0cac2d34d6ff2281d12c6218cf1398313

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3424 3828 WerFault.exe NEW requirement.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3424	WerFault.exe
3424	WerFault.exe
3424	WerFault.exe
3424	WerFault.exe
3424	WerFault.exe
3424	WerFault.exe
3424	WerFault.exe
3424	WerFault.exe
3424	WerFault.exe
3424	WerFault.exe
3424	WerFault.exe
3424	WerFault.exe
3424	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3424 WerFault.exe
Token: SeBackupPrivilege 3424 WerFault.exe
Token: SeDebugPrivilege 3424 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\NEW requirement.exe
"C:\Users\Admin\AppData\Local\Temp\NEW requirement.exe"
1⤵
PID:3828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 1136
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3424-0-0x0000000004D00000-0x0000000004D01000-memory.dmp

Filesize
4KB

Download
memory/3424-1-0x0000000004D00000-0x0000000004D01000-memory.dmp

Filesize
4KB

Download
memory/3424-3-0x0000000005630000-0x0000000005631000-memory.dmp

Filesize
4KB

Download