262832d392a1868d40f80cb80ed874ef7feb62e08a6c78b010530902f2fc659d | Triage

Analysis

max time kernel
67s
max time network
110s
platform
windows10_x64
resource
win10
submitted
09/07/2020, 12:19

Sharing

Report Analysis Logs

General

Target

SZÁMLÁK ÉS SZÁLLÍTÁSOK.exe
Size

558KB
MD5

48e7d87a5b455577e32367b135fe5443
SHA1

166ed989d15499df23aae8392839e059273489c2
SHA256

262832d392a1868d40f80cb80ed874ef7feb62e08a6c78b010530902f2fc659d
SHA512

bea90be7067478fab17d949d413de60d3b878530e9d4ffbaf35f31c0a4dd4738bb79eac9283af30e58b78d218161ce99db7ac5dafd9675ca83f9af572625790a

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3852	2728	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3852	WerFault.exe
Token: SeBackupPrivilege	3852	WerFault.exe
Token: SeDebugPrivilege	3852	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\SZÁMLÁK ÉS SZÁLLÍTÁSOK.exe
"C:\Users\Admin\AppData\Local\Temp\SZÁMLÁK ÉS SZÁLLÍTÁSOK.exe"
1⤵
PID:2728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 1136
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3852-0-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

Filesize
4KB

Download
memory/3852-1-0x0000000005610000-0x0000000005611000-memory.dmp

Filesize
4KB

Download