7d3068aff051388b3332905ca9a26a10a1cd96441e3be9d908cd839088cc9d65 | Triage

Analysis

max time kernel
142s
max time network
101s
platform
windows10_x64
resource
win10v200430
submitted
09/07/2020, 07:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

The details for your perusal.exe
Size

558KB
MD5

35f7b91f31292e3c9a4d187e9a4bd4b6
SHA1

00cf753c6fc011df51acf181cb6e79dc31f35171
SHA256

7d3068aff051388b3332905ca9a26a10a1cd96441e3be9d908cd839088cc9d65
SHA512

0b03a1f9efeb651a4f527d66d84572bad7fbb9a4379169910a2674fe54a2d1b19a36dc34cb54d71aa0c8a09b44035f6dd917041f17353e1d81dc31e62bc37bd9

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2480	4004	WerFault.exe	65

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2480	WerFault.exe
2480	WerFault.exe
2480	WerFault.exe
2480	WerFault.exe
2480	WerFault.exe
2480	WerFault.exe
2480	WerFault.exe
2480	WerFault.exe
2480	WerFault.exe
2480	WerFault.exe
2480	WerFault.exe
2480	WerFault.exe
2480	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2480	WerFault.exe
Token: SeBackupPrivilege	2480	WerFault.exe
Token: SeDebugPrivilege	2480	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\The details for your perusal.exe
"C:\Users\Admin\AppData\Local\Temp\The details for your perusal.exe"
1⤵
PID:4004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 1136
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2480-0-0x00000000046E0000-0x00000000046E1000-memory.dmp

Filesize
4KB

Download
memory/2480-2-0x0000000004D20000-0x0000000004D21000-memory.dmp

Filesize
4KB

Download