54ac34141e0dbc8034bce7b1f7aa0a48511f82185e5ddde5ab7dd7c0add7e37c | Triage

Analysis

max time kernel
113s
max time network
138s
platform
windows10_x64
resource
win10
submitted
10-07-2020 12:10

Sharing

Report Analysis Logs

General

Target

54ac34141e0dbc8034bce7b1f7aa0a48511f82185e5ddde5ab7dd7c0add7e37c.exe
Size

365KB
MD5

70e8ab646c86cd5f01f3e0f7bd759e0b
SHA1

6793b6f23ea8589b094eb203c906ee818f2d930e
SHA256

54ac34141e0dbc8034bce7b1f7aa0a48511f82185e5ddde5ab7dd7c0add7e37c
SHA512

0a988a4cb6685c1808e30938f470c3bcc85cccec2b9a9ef3ffad786b087a165e9a31f6c05a649ee8106a4048aae9ae38aa9c787187cd8bc8dd7bb589b54b7354

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3792 3060 WerFault.exe 54ac34141e0dbc8034bce7b1f7aa0a48511f82185e5ddde5ab7dd7c0add7e37c.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3792 WerFault.exe
Token: SeBackupPrivilege 3792 WerFault.exe
Token: SeDebugPrivilege 3792 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe
3792	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\54ac34141e0dbc8034bce7b1f7aa0a48511f82185e5ddde5ab7dd7c0add7e37c.exe
"C:\Users\Admin\AppData\Local\Temp\54ac34141e0dbc8034bce7b1f7aa0a48511f82185e5ddde5ab7dd7c0add7e37c.exe"
1⤵
PID:3060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 1140
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3792-0-0x0000000004070000-0x0000000004071000-memory.dmp

Filesize
4KB

Download
memory/3792-1-0x00000000048A0000-0x00000000048A1000-memory.dmp

Filesize
4KB

Download