3ae8eb9d4bc0b3f87a57648f25938b346986101428a5ed2a3f6c6d68bd5f5b4d | Triage

Analysis

max time kernel
65s
max time network
104s
platform
windows10_x64
resource
win10v200430
submitted
09-07-2020 13:37

Sharing

Report Analysis Logs

General

Target

PO457812.exe
Size

977KB
MD5

e9be709ac260b6fee77c32cecdea793b
SHA1

636738162a4b5d516c15689152a93dcb4475cef1
SHA256

3ae8eb9d4bc0b3f87a57648f25938b346986101428a5ed2a3f6c6d68bd5f5b4d
SHA512

745faa24e0987c9d87412eec42a24e3e3fe2d926884c9131cb0133a583c43ad486f94f87989f96ce1062bcfce10a50431a1e0bf82083d947fc9a5578cd2f18b9

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2828 3136 WerFault.exe PO457812.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 2828 WerFault.exe
Token: SeBackupPrivilege 2828 WerFault.exe
Token: SeDebugPrivilege 2828 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
2828	WerFault.exe
2828	WerFault.exe
2828	WerFault.exe
2828	WerFault.exe
2828	WerFault.exe
2828	WerFault.exe
2828	WerFault.exe
2828	WerFault.exe
2828	WerFault.exe
2828	WerFault.exe
2828	WerFault.exe
2828	WerFault.exe
2828	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\PO457812.exe
"C:\Users\Admin\AppData\Local\Temp\PO457812.exe"
1⤵
PID:3136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 1144
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:2828

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2828-0-0x0000000004900000-0x0000000004901000-memory.dmp

Filesize
4KB

Download
memory/2828-1-0x0000000004900000-0x0000000004901000-memory.dmp

Filesize
4KB

Download
memory/2828-3-0x0000000005130000-0x0000000005131000-memory.dmp

Filesize
4KB

Download