5e89838b965d79a4782b3f1079a810f8a801c0b91e0cd71081d9580d1b954f70 | Triage

Analysis

max time kernel
88s
max time network
97s
platform
windows10_x64
resource
win10
submitted
09-07-2020 07:39

Sharing

Report Analysis Logs

General

Target

g6U2rSph70sSCrs.exe
Size

1.1MB
MD5

c5a8bc40ff71edd375159f5acb24727b
SHA1

ac2193a30406e97ee9f3b6a19818b0c684179af1
SHA256

5e89838b965d79a4782b3f1079a810f8a801c0b91e0cd71081d9580d1b954f70
SHA512

50828348ade4301137419e26da067f2a3799b1b8a5b5c81dc534921242c8f79f97a89d9fc5ebbbce57d739f557fec5f3f5c0f4d661cb786f79c9ad8b0033374d

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

748 3924 WerFault.exe g6U2rSph70sSCrs.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 748 WerFault.exe
Token: SeBackupPrivilege 748 WerFault.exe
Token: SeDebugPrivilege 748 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
748	WerFault.exe
748	WerFault.exe
748	WerFault.exe
748	WerFault.exe
748	WerFault.exe
748	WerFault.exe
748	WerFault.exe
748	WerFault.exe
748	WerFault.exe
748	WerFault.exe
748	WerFault.exe
748	WerFault.exe
748	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\g6U2rSph70sSCrs.exe
"C:\Users\Admin\AppData\Local\Temp\g6U2rSph70sSCrs.exe"
1⤵
PID:3924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 1160
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/748-0-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

Filesize
4KB

Download
memory/748-1-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

Filesize
4KB

Download
memory/748-3-0x0000000005320000-0x0000000005321000-memory.dmp

Filesize
4KB

Download