1185a36c1a6d99bb23d9d0b0ece0a927a5ae89aeea3a78bcf30897595dfadc69 | Triage

Analysis

max time kernel
123s
max time network
126s
platform
windows10_x64
resource
win10
submitted
10/07/2020, 07:16

Sharing

Report Analysis Logs

General

Target

PO#98757.exe
Size

684KB
MD5

aa40120afe0290b5e7087dfa6e683bd5
SHA1

a7499d3bd4f250c373eb9d3cd13c1bad57a4291e
SHA256

1185a36c1a6d99bb23d9d0b0ece0a927a5ae89aeea3a78bcf30897595dfadc69
SHA512

cd7071c21d5198c4a9365c577d1eb77532230f5d362c6c24b0b5b4205fcb0d9ee1f0cba24ea437c663dae7284a705d1a071ceb74992c1ce2f1b4dfe881c40dbd

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3776	720	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
720	PO#98757.exe
3776	WerFault.exe
3776	WerFault.exe
3776	WerFault.exe
3776	WerFault.exe
3776	WerFault.exe
3776	WerFault.exe
3776	WerFault.exe
3776	WerFault.exe
3776	WerFault.exe
3776	WerFault.exe
3776	WerFault.exe
3776	WerFault.exe
3776	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	720	PO#98757.exe
Token: SeRestorePrivilege	3776	WerFault.exe
Token: SeBackupPrivilege	3776	WerFault.exe
Token: SeDebugPrivilege	3776	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\PO#98757.exe
"C:\Users\Admin\AppData\Local\Temp\PO#98757.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 720 -s 1264
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3776-0-0x0000000004570000-0x0000000004571000-memory.dmp

Filesize
4KB

Download
memory/3776-1-0x0000000004AB0000-0x0000000004AB1000-memory.dmp

Filesize
4KB

Download