7d3068aff051388b3332905ca9a26a10a1cd96441e3be9d908cd839088cc9d65 | Triage

Analysis

max time kernel
142s
max time network
101s
platform
windows10_x64
resource
win10v200430
submitted
09-07-2020 07:28

Sharing

Report Analysis Logs

General

Target

The details for your perusal.exe
Size

558KB
MD5

35f7b91f31292e3c9a4d187e9a4bd4b6
SHA1

00cf753c6fc011df51acf181cb6e79dc31f35171
SHA256

7d3068aff051388b3332905ca9a26a10a1cd96441e3be9d908cd839088cc9d65
SHA512

0b03a1f9efeb651a4f527d66d84572bad7fbb9a4379169910a2674fe54a2d1b19a36dc34cb54d71aa0c8a09b44035f6dd917041f17353e1d81dc31e62bc37bd9

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2480 4004 WerFault.exe The details for your perusal.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
2480	WerFault.exe
2480	WerFault.exe
2480	WerFault.exe
2480	WerFault.exe
2480	WerFault.exe
2480	WerFault.exe
2480	WerFault.exe
2480	WerFault.exe
2480	WerFault.exe
2480	WerFault.exe
2480	WerFault.exe
2480	WerFault.exe
2480	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2480 WerFault.exe
Token: SeBackupPrivilege 2480 WerFault.exe
Token: SeDebugPrivilege 2480 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\The details for your perusal.exe
"C:\Users\Admin\AppData\Local\Temp\The details for your perusal.exe"
1⤵
PID:4004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 1136
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2480-0-0x00000000046E0000-0x00000000046E1000-memory.dmp

Filesize
4KB

Download
memory/2480-2-0x0000000004D20000-0x0000000004D21000-memory.dmp

Filesize
4KB

Download