83a21a86c71e9d4f27c6f5877bc7390dc286212164d22adc2f5432729b5e2535 | Triage

Analysis

max time kernel
143s
max time network
148s
platform
windows7_x64
resource
win7
submitted
09-07-2020 13:45

Sharing

Report Analysis Logs

General

Target

83a21a86c71e9d4f27c6f5877bc7390dc286212164d22adc2f5432729b5e2535.exe
Size

6KB
MD5

3557759c0abdd11ec4b36493a8cd4b16
SHA1

de561a654bc3834e41ae5b781f9c8314065c0fc0
SHA256

83a21a86c71e9d4f27c6f5877bc7390dc286212164d22adc2f5432729b5e2535
SHA512

523a112495eade06b69debf2cbe4fe35973bfcb04541637e581f1fdbdc45c9f8a742e3850b05539d4211122a357ac39a833cef0068f699e87472077b0d8d5a77

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1616 1508 WerFault.exe 83a21a86c71e9d4f27c6f5877bc7390dc286212164d22adc2f5432729b5e2535.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

83a21a86c71e9d4f27c6f5877bc7390dc286212164d22adc2f5432729b5e2535.exe

description	pid	process	target process
PID 1508 wrote to memory of 1616	1508	83a21a86c71e9d4f27c6f5877bc7390dc286212164d22adc2f5432729b5e2535.exe	WerFault.exe
PID 1508 wrote to memory of 1616	1508	83a21a86c71e9d4f27c6f5877bc7390dc286212164d22adc2f5432729b5e2535.exe	WerFault.exe
PID 1508 wrote to memory of 1616	1508	83a21a86c71e9d4f27c6f5877bc7390dc286212164d22adc2f5432729b5e2535.exe	WerFault.exe
PID 1508 wrote to memory of 1616	1508	83a21a86c71e9d4f27c6f5877bc7390dc286212164d22adc2f5432729b5e2535.exe	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1616 WerFault.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

1616 WerFault.exe
1616 WerFault.exe
1616 WerFault.exe
1616 WerFault.exe
1616 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1616 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\83a21a86c71e9d4f27c6f5877bc7390dc286212164d22adc2f5432729b5e2535.exe
"C:\Users\Admin\AppData\Local\Temp\83a21a86c71e9d4f27c6f5877bc7390dc286212164d22adc2f5432729b5e2535.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 548
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1616-0-0x0000000000000000-mapping.dmp

Download
memory/1616-1-0x0000000001E40000-0x0000000001E51000-memory.dmp

Filesize
68KB

Download
memory/1616-2-0x0000000002540000-0x0000000002551000-memory.dmp

Filesize
68KB

Download