8459e6fc893b7dd880895eb1be14cf8a3bec6003bbb8493f819e48ba84491b87 | Triage

Analysis

max time kernel
149s
max time network
149s
platform
windows10_x64
resource
win10
submitted
09-07-2020 07:39

Sharing

Report Analysis Logs

General

Target

F2EzKUpFLjTmAQl.exe
Size

1.1MB
MD5

96a9c353590be3958e382b08ba97a56b
SHA1

f1e86a114513e89ee754cd1775432c12540e7481
SHA256

8459e6fc893b7dd880895eb1be14cf8a3bec6003bbb8493f819e48ba84491b87
SHA512

2cb8ef090ff0928e05875851f8491d416c25e795c49e10fbe1195a0801f8460d1738ab643a88225ecdb7486e7f6156ff80201251a52b2a57d7c142f50d4c850f

Score

3^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe
3800	WerFault.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3800 3588 WerFault.exe F2EzKUpFLjTmAQl.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3800 WerFault.exe
Token: SeBackupPrivilege 3800 WerFault.exe
Token: SeDebugPrivilege 3800 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\F2EzKUpFLjTmAQl.exe
"C:\Users\Admin\AppData\Local\Temp\F2EzKUpFLjTmAQl.exe"
1⤵
PID:3588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1160
2⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3800-0-0x00000000049F0000-0x00000000049F1000-memory.dmp

Filesize
4KB

Download
memory/3800-1-0x00000000049F0000-0x00000000049F1000-memory.dmp

Filesize
4KB

Download
memory/3800-3-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

Filesize
4KB

Download
memory/3800-4-0x00000000051F0000-0x00000000051F1000-memory.dmp

Filesize
4KB

Download