262832d392a1868d40f80cb80ed874ef7feb62e08a6c78b010530902f2fc659d | Triage

Analysis

max time kernel
67s
max time network
110s
platform
windows10_x64
resource
win10
submitted
09-07-2020 12:19

Sharing

Report Analysis Logs

General

Target

SZÁMLÁK ÉS SZÁLLÍTÁSOK.exe
Size

558KB
MD5

48e7d87a5b455577e32367b135fe5443
SHA1

166ed989d15499df23aae8392839e059273489c2
SHA256

262832d392a1868d40f80cb80ed874ef7feb62e08a6c78b010530902f2fc659d
SHA512

bea90be7067478fab17d949d413de60d3b878530e9d4ffbaf35f31c0a4dd4738bb79eac9283af30e58b78d218161ce99db7ac5dafd9675ca83f9af572625790a

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3852 2728 WerFault.exe SZÁMLÁK ÉS SZÁLLÍTÁSOK.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe
3852	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3852 WerFault.exe
Token: SeBackupPrivilege 3852 WerFault.exe
Token: SeDebugPrivilege 3852 WerFault.exe

C:\Users\Admin\AppData\Local\Temp\SZÁMLÁK ÉS SZÁLLÍTÁSOK.exe
"C:\Users\Admin\AppData\Local\Temp\SZÁMLÁK ÉS SZÁLLÍTÁSOK.exe"
1⤵
PID:2728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 1136
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3852-0-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

Filesize
4KB

Download
memory/3852-1-0x0000000005610000-0x0000000005611000-memory.dmp

Filesize
4KB

Download