Analysis
-
max time kernel
142s -
max time network
101s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
09-07-2020 07:28
Static task
static1
Behavioral task
behavioral1
Sample
The details for your perusal.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
The details for your perusal.exe
Resource
win10v200430
0 signatures
0 seconds
General
-
Target
The details for your perusal.exe
-
Size
558KB
-
MD5
35f7b91f31292e3c9a4d187e9a4bd4b6
-
SHA1
00cf753c6fc011df51acf181cb6e79dc31f35171
-
SHA256
7d3068aff051388b3332905ca9a26a10a1cd96441e3be9d908cd839088cc9d65
-
SHA512
0b03a1f9efeb651a4f527d66d84572bad7fbb9a4379169910a2674fe54a2d1b19a36dc34cb54d71aa0c8a09b44035f6dd917041f17353e1d81dc31e62bc37bd9
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2480 4004 WerFault.exe The details for your perusal.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
WerFault.exepid process 2480 WerFault.exe 2480 WerFault.exe 2480 WerFault.exe 2480 WerFault.exe 2480 WerFault.exe 2480 WerFault.exe 2480 WerFault.exe 2480 WerFault.exe 2480 WerFault.exe 2480 WerFault.exe 2480 WerFault.exe 2480 WerFault.exe 2480 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 2480 WerFault.exe Token: SeBackupPrivilege 2480 WerFault.exe Token: SeDebugPrivilege 2480 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\The details for your perusal.exe"C:\Users\Admin\AppData\Local\Temp\The details for your perusal.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 11362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken