718612fc81bf6ba414792fdd4167f7571295b147c14377130931f4a096fac2f2 | Triage

Analysis

max time kernel
95s
max time network
117s
platform
windows10_x64
resource
win10
submitted
09/07/2020, 12:16

Sharing

Report Analysis Logs

General

Target

Scan Document 06311_PNG.exe
Size

869KB
MD5

26ca848025d9021542081e7983e577b9
SHA1

2db08626337ac47a8c024bd1ec0f9da603c762d0
SHA256

718612fc81bf6ba414792fdd4167f7571295b147c14377130931f4a096fac2f2
SHA512

22d81689a3ee8cba9c99ad9170ed558affd3a3bff9f4dc6ca52c395f85a96af94290e43df5d865762e8ba71e53cffbc420b7586e05d1aff88ba34a362a7a7cef

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3940	748	WerFault.exe	65

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe
3940	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3940	WerFault.exe
Token: SeBackupPrivilege	3940	WerFault.exe
Token: SeDebugPrivilege	3940	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Scan Document 06311_PNG.exe
"C:\Users\Admin\AppData\Local\Temp\Scan Document 06311_PNG.exe"
1⤵
PID:748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 1140
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3940-0-0x0000000004550000-0x0000000004551000-memory.dmp

Filesize
4KB

Download
memory/3940-1-0x0000000004550000-0x0000000004551000-memory.dmp

Filesize
4KB

Download
memory/3940-3-0x0000000004D80000-0x0000000004D81000-memory.dmp

Filesize
4KB

Download