de638d68163fe7f49b3371adbe9456b2c2ed2ef5182324e768dc42793591c7de | Triage

Analysis

max time kernel
69s
max time network
95s
platform
windows10_x64
resource
win10
submitted
10-07-2020 07:06

Sharing

Report Analysis Logs

General

Target

WT0045679.exe
Size

428KB
MD5

8b721799c0f207360c4077fe7a3a1c24
SHA1

6574355e2c48b72c2ab2e4476e4168602f4c2b65
SHA256

de638d68163fe7f49b3371adbe9456b2c2ed2ef5182324e768dc42793591c7de
SHA512

80fb3644df03c06296a865128d021ec9c7258e39d40d986e53f611402173c3972add21f49013ac1c82d159e7bb473e8e3ea8c2b71b34a8c9efe0078712a32eaa

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3864	3820	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe
3864	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3864	WerFault.exe
Token: SeBackupPrivilege	3864	WerFault.exe
Token: SeDebugPrivilege	3864	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\WT0045679.exe
"C:\Users\Admin\AppData\Local\Temp\WT0045679.exe"
1⤵
PID:3820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3820 -s 912
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3864-0-0x0000000004F10000-0x0000000004F11000-memory.dmp

Filesize
4KB

Download
memory/3864-1-0x0000000005450000-0x0000000005451000-memory.dmp

Filesize
4KB

Download