feab2c3085065afaf7682bfb8fcfbca28ac3324132735d9e17ada750b9597e23 | Triage

Analysis

max time kernel
145s
max time network
132s
platform
windows10_x64
resource
win10v200430
submitted
09-07-2020 13:47

Sharing

Report Analysis Logs

General

Target

image0056.exe
Size

554KB
MD5

cf30f1a4eb0d27d4cdab2c32329622fa
SHA1

7c02023f6f01595aaf0fe6cbe3e5cf3f06c80b5d
SHA256

feab2c3085065afaf7682bfb8fcfbca28ac3324132735d9e17ada750b9597e23
SHA512

551aa6294adda3b40c91c9fe7d1c58656f74d21ebcb9dd2442c92770a562cabdba459dd3e1c275bf48e5472929ad631d538665f112c394a8d6944766fc504290

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

8 3832 WerFault.exe image0056.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
8	WerFault.exe
8	WerFault.exe
8	WerFault.exe
8	WerFault.exe
8	WerFault.exe
8	WerFault.exe
8	WerFault.exe
8	WerFault.exe
8	WerFault.exe
8	WerFault.exe
8	WerFault.exe
8	WerFault.exe
8	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 8 WerFault.exe
Token: SeBackupPrivilege 8 WerFault.exe
Token: SeDebugPrivilege 8 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\image0056.exe
"C:\Users\Admin\AppData\Local\Temp\image0056.exe"
1⤵
PID:3832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3832 -s 1140
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:8

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/8-0-0x0000000004C00000-0x0000000004C01000-memory.dmp

Filesize
4KB

Download
memory/8-1-0x0000000005340000-0x0000000005341000-memory.dmp

Filesize
4KB

Download