8a6b671ef4fc65efa1bd306da35f4bf2a18814d1ecf0f868ff2f27177fb37809 | Triage

Analysis

max time kernel
149s
max time network
103s
platform
windows10_x64
resource
win10v200430
submitted
09-07-2020 08:00

Sharing

Report Analysis Logs

General

Target

3ba6136d2dc933a6ad089fa09408394c.exe
Size

1.1MB
MD5

3ba6136d2dc933a6ad089fa09408394c
SHA1

da87612dc3e4f16272faf9ab45364f700446d118
SHA256

8a6b671ef4fc65efa1bd306da35f4bf2a18814d1ecf0f868ff2f27177fb37809
SHA512

04648deb91ff8462f5be419265c91752184d9f96b7ae6e266fe337284cae5ecb4e883ebf7cfb1ddd2014f3c88ee16cb7a928baca54083b761d6aa9e1da63b861

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2080 2612 WerFault.exe 3ba6136d2dc933a6ad089fa09408394c.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe
2080	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

3ba6136d2dc933a6ad089fa09408394c.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	2612	3ba6136d2dc933a6ad089fa09408394c.exe
Token: SeRestorePrivilege	2080	WerFault.exe
Token: SeBackupPrivilege	2080	WerFault.exe
Token: SeDebugPrivilege	2080	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\3ba6136d2dc933a6ad089fa09408394c.exe
"C:\Users\Admin\AppData\Local\Temp\3ba6136d2dc933a6ad089fa09408394c.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 1156
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2080-0-0x0000000004580000-0x0000000004581000-memory.dmp

Filesize
4KB

Download
memory/2080-1-0x0000000004CC0000-0x0000000004CC1000-memory.dmp

Filesize
4KB

Download