df745e4434b953ab404e59ef73608a9f3148fa7d629a28b7401c295efdf618b6 | Triage

Analysis

max time kernel
146s
max time network
152s
platform
windows10_x64
resource
win10
submitted
10-07-2020 07:35

Sharing

Report Analysis Logs

General

Target

purchase list.exe
Size

342KB
MD5

d6f63695191aecfe9c2a83523e2dce38
SHA1

d68c0ab1f06ee7a8da74badc7d36f5ad619efb1b
SHA256

df745e4434b953ab404e59ef73608a9f3148fa7d629a28b7401c295efdf618b6
SHA512

1165bd682e1c508752a1facab8603283ed9104c360d35c09cae7991e0f6c69d1851d34c6392ddef55e52e4bf266104bf218ea002332fdb19f9763c92a8b41fa6

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3828 732 WerFault.exe purchase list.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3828 WerFault.exe
Token: SeBackupPrivilege 3828 WerFault.exe
Token: SeDebugPrivilege 3828 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3828	WerFault.exe
3828	WerFault.exe
3828	WerFault.exe
3828	WerFault.exe
3828	WerFault.exe
3828	WerFault.exe
3828	WerFault.exe
3828	WerFault.exe
3828	WerFault.exe
3828	WerFault.exe
3828	WerFault.exe
3828	WerFault.exe
3828	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\purchase list.exe
"C:\Users\Admin\AppData\Local\Temp\purchase list.exe"
1⤵
PID:732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 912
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3828

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3828-0-0x00000000047B0000-0x00000000047B1000-memory.dmp

Filesize
4KB

Download
memory/3828-1-0x00000000047B0000-0x00000000047B1000-memory.dmp

Filesize
4KB

Download
memory/3828-3-0x0000000004A20000-0x0000000004A21000-memory.dmp

Filesize
4KB

Download